omniauth-facebook Cross-Site Request Forgery vulnerability

MITTEL 6.8CVE-2013-4562 · GHSA-cf36-985g-v73c · Published 13/05/2014 · updated 16/06/2026

Kurz gesagt

CVE-2013-4562 ist eine Schwachstelle (MITTEL (CVSS 6.8)) in omniauth-facebook, omniauth-facebook (madeofcode).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.2%, höher als bei 67.5% aller Schwachstellen.
Abhilfe: auf 1.5.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
omniauth-facebook RubyGems	`≥ 1.4.1, < 1.5.0`	`1.5.0`
omniauth-facebook madeofcode	`= 1.4.1`	No fix yet

Description

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.

NVD description

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.

References

nvd.nist.gov/vuln/detail/CVE-2013-4562 · ADVISORY
mkdynamic/omniauth-facebook commit ccfcc26 · WEB
mkdynamic/omniauth-faceboo · PACKAGE
groups.google.com/d/msg/ruby-security-ann/-tJHNlTiPh4/9SJxdEWLIawJ · WEB
seclists.org/oss-sec/2013/q4/264 · WEB
seclists.org/oss-sec/2013/q4/267 · WEB
osvdb.org/ref/99/omniauth-facebook_gem.txt
osvdb.org/99693

Weitere Schwachstellen in omniauth-facebook

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free