CVE-2008-7248
CVE-2008-7248
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
EPSS 8,1% · Código de explotación público · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
n/a
- Versiones
- n/a: Afectada
Sin corrección publicada
rails Debian:12
- Intervalos de versiones afectados
- ECOSYSTEM: < 2.2.3-1
Actualiza a 2.2.3-1
rails Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 2.2.3-1
Actualiza a 2.2.3-1
rails Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 2.2.3-1
Actualiza a 2.2.3-1
Fuentes originales
- http://www.openwall.com/lists/oss-security/2009/11/28/1
- http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html
- http://secunia.com/advisories/36600
- http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/
- http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
- http://www.vupen.com/english/advisories/2009/2544
- http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en
- http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
- http://www.openwall.com/lists/oss-security/2009/12/02/2
- http://secunia.com/advisories/38915
- https://nvd.nist.gov/vuln/detail/CVE-2008-7248