Description
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | omniauth-facebook | >= 1.4.1, < 1.5.0 | 1.5.0 | GHSA-cf36-985g-v73c |
References
- [oss-security] 20131112 CVE request: rubygem omniauth-facebook CSRF vurnerability mailing-list
- 99693 vdb-entry
- https://github.com/mkdynamic/omniauth-facebook/commit/ccfcc26fe7e34acbd75ad4a095fd01ce5ff48ee7
- [ruby-security-ann] 20131114 [CVE-2013-4562] RubyGem omniauth-facebook CSRF vulnerability mailing-list
- http://osvdb.org/ref/99/omniauth-facebook_gem.txt
- [oss-security] 20131112 Re: Re: CVE request: rubygem omniauth-facebook CSRF vurnerability mailing-list