omniauth-facebook Cross-Site Request Forgery vulnerability

MEDIUM 6.8CVE-2013-4562 · GHSA-cf36-985g-v73c · Published 13/05/2014 · updated 16/06/2026

In short

CVE-2013-4562 is a MEDIUM (CVSS 6.8) vulnerability affecting omniauth-facebook, omniauth-facebook (madeofcode).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.5% of all vulnerabilities.
Fix: update to 1.5.0 or later.

Package	Affected versions	Patched versions
omniauth-facebook RubyGems	`≥ 1.4.1, < 1.5.0`	`1.5.0`
omniauth-facebook madeofcode	`= 1.4.1`	No fix yet

Description

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.

NVD description

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.

References

nvd.nist.gov/vuln/detail/CVE-2013-4562 · ADVISORY
mkdynamic/omniauth-facebook commit ccfcc26 · WEB
mkdynamic/omniauth-faceboo · PACKAGE
groups.google.com/d/msg/ruby-security-ann/-tJHNlTiPh4/9SJxdEWLIawJ · WEB
seclists.org/oss-sec/2013/q4/264 · WEB
seclists.org/oss-sec/2013/q4/267 · WEB
osvdb.org/ref/99/omniauth-facebook_gem.txt
osvdb.org/99693

More vulnerabilities in omniauth-facebook

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free