Cross-site request forgery (CSRF) vulnerability in Spina gem
Published: June 16, 2015
SECURITY IDENTIFIERS
- CVE: CVE-2015-4619 (NVD)
- GHSA: GHSA-2hxv-mx8x-mcj9
- Vendor Advisory: http://www.openwall.com/lists/oss-security/2015/06/16/11
GEM
SEVERITY
CVSS v3.x: 8.8 (High)
PATCHED VERSIONS
>= 0.6.29
DESCRIPTION
"Spina::ApplicationController actions didn't have CSRF protection.
This causes a CSRF vulnerability across the entire engine which includes administrative
functionality such as creating users, changing passwords, and media management."
RELATED
- https://nvd.nist.gov/vuln/detail/CVE-2015-4619
- https://github.com/denkGroot/Spina/commit/bfe44f289e336f80b6593032679300c493735e75
- https://sca.analysiscenter.veracode.com/vulnerability-database/security/cross-site-request-forgery-csrf/ruby/sid-1686/summary
- https://github.com/rubysec/ruby-advisory-db/issues/238