GHSA-2hxv-mx8x-mcj9

Suggest an improvement
Source
https://github.com/advisories/GHSA-2hxv-mx8x-mcj9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-2hxv-mx8x-mcj9/GHSA-2hxv-mx8x-mcj9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2hxv-mx8x-mcj9
Aliases
  • CVE-2015-4619
Published
2018-08-28T22:34:22Z
Modified
2024-02-16T08:14:22Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability
Details

Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75. Spina::ApplicationController actions didn't have CSRF protection. This causes a CSRF vulnerability across the entire engine which includes administrative functionality such as creating users, changing passwords, and media management.

Database specific 
{
    "cwe_ids": [
        "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:52:12Z",
    "nvd_published_at": "2017-09-07T20:29:00Z",
    "severity": "HIGH"
}
References

Affected packages

RubyGems / spina

Package

Name
spina
Purl
pkg:gem/spina

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.6.29

Affected versions

0.*
0.6.11
0.6.12
0.6.13
0.6.14
0.6.15
0.6.16
0.6.17
0.6.18
0.6.19
0.6.20
0.6.21
0.6.22
0.6.23
0.6.24
0.6.25
0.6.26
0.6.27
0.6.28

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-2hxv-mx8x-mcj9/GHSA-2hxv-mx8x-mcj9.json"