CVE-2015-9284

State: Published
Severity: Not scored
Published: Apr 26, 2019
Updated: Aug 6, 2024
Reserved: Apr 9, 2019

Description

The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.

Scores

The record has no CVSS score.

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF) (CWE-352)

Affected Products

Product	Versions
omniauth ruby gemn/a	All versionsAffected

References

https://github.com/omniauth/omniauth/pull/809
https://github.com/omniauth/omniauth-rails/pull/1
[oss-security] 20150526 CVE Request: CSRF vulnerability in OmniAuth request phasemailing-list
https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.