GHSA-v6fx-752r-ccp2HighCVSS 8.1
PgHero gem allows CSRF
🔗 CVE IDs covered (1)
📋 Description
The PgHero gem through 2.6.0 for Ruby allows CSRF. PgHero normally uses the protect_from_forgery method from Rails to prevent CSRF. However, this defaults to :null_session, which has no effect on non-session based authentication methods. Thus the ruby gem is vulnerable with non-session based authentication methods like basic authentication.
🎯 Affected products1
- rubygems/pghero:< 2.7.0
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2020-16253
- https://github.com/ankane/pghero/issues/330
- https://github.com/ankane/pghero/commit/14b67b32fed19a30aaf9826ee72f2a29cda604e9
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pghero/CVE-2020-16253.yml
- https://github.com/advisories/GHSA-v6fx-752r-ccp2