omniauth-facebook Cross-Site Request Forgery vulnerability

MÉDIO 6.8CVE-2013-4562 · GHSA-cf36-985g-v73c · Published 13/05/2014 · updated 16/06/2026

Em resumo

CVE-2013-4562 é uma vulnerabilidade MÉDIO (CVSS 6.8) que afeta omniauth-facebook, omniauth-facebook (madeofcode).
Chance de exploração nos próximos 30 dias (EPSS): 1.2%, maior que 67.5% das vulnerabilidades.
Correção: atualize para 1.5.0 ou posterior.

Package	Affected versions	Patched versions
omniauth-facebook RubyGems	`≥ 1.4.1, < 1.5.0`	`1.5.0`
omniauth-facebook madeofcode	`= 1.4.1`	No fix yet

Description

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.

NVD description

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.

References

nvd.nist.gov/vuln/detail/CVE-2013-4562 · ADVISORY
mkdynamic/omniauth-facebook commit ccfcc26 · WEB
mkdynamic/omniauth-faceboo · PACKAGE
groups.google.com/d/msg/ruby-security-ann/-tJHNlTiPh4/9SJxdEWLIawJ · WEB
seclists.org/oss-sec/2013/q4/264 · WEB
seclists.org/oss-sec/2013/q4/267 · WEB
osvdb.org/ref/99/omniauth-facebook_gem.txt
osvdb.org/99693

Mais vulnerabilidades de omniauth-facebook

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free