Kurz gesagt
- CVE-2017-18076 ist eine Schwachstelle (HOCH (CVSS 7.5)) in omniauth, omniauth (omniauth).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.1%, höher als bei 81.9% aller Schwachstellen.
- Abhilfe: auf 1.3.2 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| omniauth RubyGems | < 1.3.2
| 1.3.2
|
| omniauth | < 1.3.2
| 1.3.2
|
Description
In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.
NVD description
In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free