Cross-Site Request Forgery (CSRF) in trestle-auth
Published: April 14, 2021
SECURITY IDENTIFIERS
- CVE: CVE-2021-29435 (NVD)
- GHSA: GHSA-h8hx-2c5r-32cf
- Vendor Advisory: https://github.com/TrestleAdmin/trestle-auth/security/advisories/GHSA-h8hx-2c5r-32cf
GEM
SEVERITY
CVSS v3.x: 8.1 (High)
UNAFFECTED VERSIONS
< 0.4.0
PATCHED VERSIONS
>= 0.4.2
DESCRIPTION
Impact
A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials.
Patches
The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.