GHSA-v6fx-752r-ccp2

Source

https://github.com/advisories/GHSA-v6fx-752r-ccp2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-v6fx-752r-ccp2/GHSA-v6fx-752r-ccp2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v6fx-752r-ccp2

Aliases

CVE-2020-16253

Published

2020-08-05T14:53:43Z

Modified

2024-02-16T08:23:18.681389Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS Calculator

Summary

PgHero gem allows CSRF

Details

The PgHero gem through 2.6.0 for Ruby allows CSRF. PgHero normally uses the protect_from_forgery method from Rails to prevent CSRF. However, this defaults to :null_session, which has no effect on non-session based authentication methods. Thus the ruby gem is vulnerable with non-session based authentication methods like basic authentication.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-05T14:51:45Z"
}

References

Affected packages

RubyGems / pghero

Package

Name: pghero
Purl: pkg:gem/pghero

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.7.0

Affected versions

0.*

0.0.1

0.0.2

0.0.3

0.1.0

0.1.1

0.1.2

0.1.3

0.1.4

0.1.5

0.1.6

0.1.7

0.1.8

0.1.9

0.1.10

1.*

1.0.0

1.0.1

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.3.0

1.3.1

1.3.2

1.4.0

1.4.1

1.4.2

1.5.0

1.5.1

1.5.2

1.5.3

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.7.0

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.1.0

2.1.1

2.2.0

2.2.1

2.3.0

2.4.0

2.4.1

2.4.2

2.5.0

2.5.1

2.6.0