Description (CNA)
A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / https://github.com/rails/rails | affected Fixed in 5.2.4.3, 6.0.3.1 |
CWE
CWE-352
References
- https://hackerone.com/reports/732415
- https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw
- https://www.debian.org/security/2020/dsa-4766
ADP enrichment
No English description supplied.
No English description supplied.