Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability

ALTO 8.8CVE-2015-4619 · GHSA-2hxv-mx8x-mcj9 · Published 07/09/2017 · updated 17/06/2026

In breve

CVE-2015-4619 è una vulnerabilità ALTO (CVSS 8.8) che riguarda spina, spina (denkgroot).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.90%, superiore al 59.9% delle vulnerabilità.
Correzione: aggiornare a 0.6.29 o successiva.

Package	Affected versions	Patched versions
spina RubyGems	`< 0.6.29`	`0.6.29`
spina denkgroot	`≤ 0.11.1`	No fix yet

Description

Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75. Spina::ApplicationController actions didn't have CSRF protection. This causes a CSRF vulnerability across the entire engine which includes administrative functionality such as creating users, changing passwords, and media management.

NVD description

Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.

References

nvd.nist.gov/vuln/detail/CVE-2015-4619 · ADVISORY
denkGroot/Spina commit bfe44f2 · WEB
denkGroot/Spina · PACKAGE
rubysec/ruby-advisory-db · WEB
openwall.com/lists/oss-security/2015/06/16/11 · WEB
openwall.com/lists/oss-security/2015/06/16/20 · WEB
securityfocus.com/bid/75216 · WEB

Altre vulnerabilità di spina

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

spina

RubyGems

< 0.6.29

0.6.29

spina

denkgroot

≤ 0.11.1

No fix yet

Description

NVD description

Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.