Description (CNA)
A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / http://github.com/rails/rails | affected Fixed in 5.2.4.3, 6.0.3.1 |
CWE
CWE-352
References
- https://hackerone.com/reports/189878
- https://groups.google.com/g/rubyonrails-security/c/x9DixQDG9a0
- https://www.debian.org/security/2020/dsa-4766
ADP enrichment
No English description supplied.