GHSA-cf36-985g-v73cMedium

omniauth-facebook Cross-Site Request Forgery vulnerability

Published
October 24, 2017
Last Modified
November 10, 2023

🔗 CVE IDs covered (1)

CVE-2013-4562 →

📋 Description

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.

🎯 Affected products1

  • rubygems/omniauth-facebook:>= 1.4.1, < 1.5.0

🔗 References (6)