CVE-2008-7248
- State
- Published
- Severity
- Not scored
- Published
- Dec 16, 2009
- Updated
- Aug 7, 2024
- Reserved
- Dec 11, 2009
Description
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [oss-security] 20091128 CVE request: Ruby on Rails: CSRF circumvention (from 2008)mailing-list
- http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html
- 36600third-party-advisory
- http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/
- http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
- ADV-2009-2544vdb-entry
- http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en
- SUSE-SR:2010:006vendor-advisory
- [oss-security] 20091202 Re: CVE request: Ruby on Rails: CSRF circumvention (from 2008)mailing-list
- 38915third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.