En bref
- CVE-2021-29435 est une vulnérabilité MOYENNE (CVSS 6.5) touchant trestle-auth, trestle-auth (trestle-auth project).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.66%, plus élevée que 52.0% des vulnérabilités.
- Correctif : mettre à jour vers 0.4.2 ou plus récent.
Description
Impact
A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials.
Patches
The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.
For more information
If you have any questions or comments about this advisory:
NVD description
trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials. The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free