Kurz gesagt
- CVE-2021-29435 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in trestle-auth, trestle-auth (trestle-auth project).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.66%, höher als bei 52.0% aller Schwachstellen.
- Abhilfe: auf 0.4.2 oder neuer aktualisieren.
Description
Impact
A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials.
Patches
The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.
For more information
If you have any questions or comments about this advisory:
NVD description
trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials. The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free