In breve
- CVE-2021-29435 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda trestle-auth, trestle-auth (trestle-auth project).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.66%, superiore al 52.0% delle vulnerabilità.
- Correzione: aggiornare a 0.4.2 o successiva.
Description
Impact
A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials.
Patches
The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.
For more information
If you have any questions or comments about this advisory:
NVD description
trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials. The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free