Search for vulnerabilities
Vulnerability details: VCID-jqta-pv21-aaac
Vulnerability ID VCID-jqta-pv21-aaac
Aliases GMS-2015-14
Summary CSRF vulnerability In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the nhref or action to " https://attacker.com" (note the leading space) that will be passed to JQuery, who will see this as a same origin request, and send the user's CSRF token to the attacker domain.
Status Published
Exploitability 0.5
Weighted Severity 5.5
Risk 2.8
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual MODERATE https://groups.google.com/forum/#!topic/ruby-security-ann/XIZPbobuwaY
Reference id Reference type URL
https://groups.google.com/forum/#!topic/ruby-security-ann/XIZPbobuwaY
No exploits are available.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
There are no relevant records.