CVSS v3.x: 4.3 (Medium)
- ~> 5.2.4, >= 220.127.116.11
- >= 18.104.22.168
It is possible to possible to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token for any action for that session.
Versions Affected: rails < 5.2.5, rails < 6.0.4 Not affected: Applications without existing HTML injection vulnerabilities. Fixed Versions: rails >= 22.214.171.124, rails >= 126.96.36.199
Given the ability to extract the global CSRF token, an attacker would be able to construct a per-form CSRF token for that session.
This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.