Cross-Site Request Forgery (CSRF) in trestle-auth

TRUNG BÌNH 6.5CVE-2021-29435 · GHSA-h8hx-2c5r-32cf · Công bố 13/04/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-29435 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng trestle-auth, trestle-auth (trestle-auth project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.66%, cao hơn 52.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.4.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
trestle-auth RubyGems	`≥ 0.4.0, < 0.4.2`	`0.4.2`
trestle-auth trestle-auth_project	`= 0.4.0= 0.4.1`	Chưa có bản vá

Mô tả

Impact

A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials.

Patches

The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.

For more information

If you have any questions or comments about this advisory:

Open an issue in trestle-auth
Email the maintainer at [email protected]

Mô tả của NVD

trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials. The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.