Advisory details:
ruby_advisory_db / gems/actionpack/CVE-2008-7248
| Advisory ID | ruby_advisory_db/gems/actionpack/CVE-2008-7248 |
| Aliases |
CVE-2008-7248
GHSA-8fqx-7pv4-3jwm |
| Summary | Improper Input Validation in rails Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv2 | 6.8 |
| Reference id | Reference type | URL |
|---|---|---|
| https://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1 |
| Data source | Exploit-DB |
|---|---|
| Date added | Dec. 14, 2009 |
| Description | Ruby on Rails 2.3.5 - 'protect_from_forgery' Cross-Site Request Forgery |
| Ransomware campaign use | Known |
| Source publication date | Dec. 14, 2009 |
| Exploit type | remote |
| Platform | linux |
| Source update date | May 18, 2014 |
| Source URL | https://www.securityfocus.com/bid/37322/info |
| Data source | Exploit-DB |
|---|---|
| Date added | Dec. 14, 2009 |
| Description | Ruby on Rails 2.3.5 - 'protect_from_forgery' Cross-Site Request Forgery |
| Ransomware campaign use | Known |
| Source publication date | Dec. 14, 2009 |
| Exploit type | remote |
| Platform | linux |
| Source update date | May 18, 2014 |
| Source URL | https://www.securityfocus.com/bid/37322/info |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no known vectors.
There are no SSVC decisions available.