CVE-2013-4562

2014-05-1315:55:04

Debian Security Bug Tracker

security-tracker.debian.org

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.008 Low

EPSS

Percentile

81.6%

JSON

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.

OSVersionArchitecturePackageVersionFilename
Debian11allruby-omniauth-facebook< 4.0.0-2ruby-omniauth-facebook_4.0.0-2_all.deb
Debian999allruby-omniauth-facebook< 4.0.0-3ruby-omniauth-facebook_4.0.0-3_all.deb
Debian13allruby-omniauth-facebook< 4.0.0-3ruby-omniauth-facebook_4.0.0-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	all	ruby-omniauth-facebook	< 4.0.0-2	ruby-omniauth-facebook_4.0.0-2_all.deb
Debian	999	all	ruby-omniauth-facebook	< 4.0.0-3	ruby-omniauth-facebook_4.0.0-3_all.deb
Debian	13	all	ruby-omniauth-facebook	< 4.0.0-3	ruby-omniauth-facebook_4.0.0-3_all.deb