CVE-2012-6134 omniauth-oauth2 Cross-Site Request Forgery vulnerability
MediumCVSS 6.8
EPSS 1.2%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems omniauth-oauth2(RubyGems) | < 1.1.1 | 1.1.1 |
| rubygems omniauth-oauth2(RubyGems) | = 1.0.0 | No fix listed |
| rubygems omniauth-oauth2(RubyGems) | = 1.0.0.beta1 | No fix listed |
| rubygems omniauth-oauth2(RubyGems) | = 1.0.0.pr1 | No fix listed |
| rubygems omniauth-oauth2(RubyGems) | = 1.0.0.pr2 | No fix listed |
| rubygems omniauth-oauth2(RubyGems) | = 1.0.0.rc1 | No fix listed |
| rubygems omniauth-oauth2(RubyGems) | = 1.0.0.rc2 | No fix listed |
| rubygems omniauth-oauth2(RubyGems) | = 1.0.1 | No fix listed |
| rubygems omniauth-oauth2(RubyGems) | = 1.0.2 | No fix listed |
| rubygems omniauth-oauth2(RubyGems) | = 1.0.3 | No fix listed |
| rubygems omniauth-oauth2(RubyGems) | = 1.1.0 | No fix listed |
| omniauth-oauth2 project omniauth-oauth2 | < 1.1.1 | 1.1.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- rubysec.github.io broken-link
- [oss-security] 20130213 Some rubygems related CVEs mailing-list third-party-advisory
- web.archive.org
- github.com exploit
- github.com
- github.com product
- gist.github.com broken-link
- Debian Security Tracker CVE-2012-6134 vendor-advisory