thoughtbot administrate vulnerabilities

Latest thoughtbot administrate CVEs

Newest publication first

1. CVE-2016-3098 administrate vulnerable to Cross-Site Request Forgery

   Published 2022-08-05

   Medium·CVSS 5.4 EPSS 0.37% PoC

   Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.

2. CVE-2020-5257 Sort order SQL injection in Administrate

   Published 2020-03-13

   High·CVSS 8.1 EPSS 0.90% PoC

   In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the direction parameter and b...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.