RubyGems package
omniauth
pkg:gem/omniauth
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-36599 | — | < 1.9.2 | 1.9.2 | Aug 18, 2022 | lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value. | ||
| CVE-2015-9284 | — | < 2.0.0 | 2.0.0 | Apr 26, 2019 | The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary | ||
| CVE-2017-18076 | — | < 1.3.2 | 1.3.2 | Jan 26, 2018 | In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase. |
- CVE-2020-36599Aug 18, 2022affected < 1.9.2fixed 1.9.2
lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.
- CVE-2015-9284Apr 26, 2019affected < 2.0.0fixed 2.0.0
The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary
- CVE-2017-18076Jan 26, 2018affected < 1.3.2fixed 1.3.2
In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.