Vulnerability Details CVE-2015-9284
The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 73.7%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.8
References
- https://github.com/omniauth/omniauth-rails/pull/1
- https://github.com/omniauth/omniauth/pull/809
- https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
- https://www.openwall.com/lists/oss-security/2015/05/26/11
- https://github.com/omniauth/omniauth-rails/pull/1
- https://github.com/omniauth/omniauth/pull/809
- https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
- https://www.openwall.com/lists/oss-security/2015/05/26/11
Products affected by CVE-2015-9284
-
cpe:2.3:a:omniauth:omniauth:-
-
cpe:2.3:a:omniauth:omniauth:0.0.1
-
cpe:2.3:a:omniauth:omniauth:0.0.3
-
cpe:2.3:a:omniauth:omniauth:0.0.4
-
cpe:2.3:a:omniauth:omniauth:0.0.5
-
cpe:2.3:a:omniauth:omniauth:0.1.0
-
cpe:2.3:a:omniauth:omniauth:0.1.1
-
cpe:2.3:a:omniauth:omniauth:0.1.2
-
cpe:2.3:a:omniauth:omniauth:0.1.3
-
cpe:2.3:a:omniauth:omniauth:0.1.4
-
cpe:2.3:a:omniauth:omniauth:0.1.5
-
cpe:2.3:a:omniauth:omniauth:0.1.6
-
cpe:2.3:a:omniauth:omniauth:0.2.0
-
cpe:2.3:a:omniauth:omniauth:0.2.1
-
cpe:2.3:a:omniauth:omniauth:0.2.2
-
cpe:2.3:a:omniauth:omniauth:0.2.3
-
cpe:2.3:a:omniauth:omniauth:0.2.4
-
cpe:2.3:a:omniauth:omniauth:0.2.5
-
cpe:2.3:a:omniauth:omniauth:0.2.6
-
cpe:2.3:a:omniauth:omniauth:0.3.0
-
cpe:2.3:a:omniauth:omniauth:0.3.1
-
cpe:2.3:a:omniauth:omniauth:0.3.2
-
cpe:2.3:a:omniauth:omniauth:1.0.0
-
cpe:2.3:a:omniauth:omniauth:1.0.1
-
cpe:2.3:a:omniauth:omniauth:1.0.2
-
cpe:2.3:a:omniauth:omniauth:1.0.3
-
cpe:2.3:a:omniauth:omniauth:1.1.0
-
cpe:2.3:a:omniauth:omniauth:1.1.1
-
cpe:2.3:a:omniauth:omniauth:1.1.2
-
cpe:2.3:a:omniauth:omniauth:1.1.3
-
cpe:2.3:a:omniauth:omniauth:1.1.4
-
cpe:2.3:a:omniauth:omniauth:1.2.0
-
cpe:2.3:a:omniauth:omniauth:1.2.1
-
cpe:2.3:a:omniauth:omniauth:1.2.2
-
cpe:2.3:a:omniauth:omniauth:1.3.0
-
cpe:2.3:a:omniauth:omniauth:1.3.1
-
cpe:2.3:a:omniauth:omniauth:1.3.2
-
cpe:2.3:a:omniauth:omniauth:1.4.0
-
cpe:2.3:a:omniauth:omniauth:1.4.1
-
cpe:2.3:a:omniauth:omniauth:1.4.2
-
cpe:2.3:a:omniauth:omniauth:1.4.3
-
cpe:2.3:a:omniauth:omniauth:1.5.0
-
cpe:2.3:a:omniauth:omniauth:1.6.0
-
cpe:2.3:a:omniauth:omniauth:1.6.1
-
cpe:2.3:a:omniauth:omniauth:1.7.0
-
cpe:2.3:a:omniauth:omniauth:1.7.1
-
cpe:2.3:a:omniauth:omniauth:1.8.0
-
cpe:2.3:a:omniauth:omniauth:1.8.1
-
cpe:2.3:a:omniauth:omniauth:1.9.0
-
cpe:2.3:a:omniauth:omniauth:1.9.1
-
cpe:2.3:a:omniauth:omniauth:1.9.2