mkdynamic/omniauth-faceboo · Security
omniauth-facebook Cross-Site Request Forgery vulnerability
- GHSA ID
- GHSA-cf36-985g-v73c
- CVE ID
- CVE-2013-4562
- Severity
- medium
- Published
- Updated
Description
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
CWEs
- CWE-352 · Cross-Site Request Forgery (CSRF)
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-4562 ↗
- https://github.com/mkdynamic/omniauth-facebook/commit/ccfcc26fe7e34acbd75ad4a095fd01ce5ff48ee7 ↗
- https://groups.google.com/d/msg/ruby-security-ann/-tJHNlTiPh4/9SJxdEWLIawJ ↗
- http://seclists.org/oss-sec/2013/q4/264 ↗
- http://seclists.org/oss-sec/2013/q4/267 ↗
- https://github.com/advisories/GHSA-cf36-985g-v73c ↗