Cross-site Request Forgery (CSRF)

🗓️ 27 Dec 2016 01:13:34Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 27 Views

Vulnerability in rails_admin and other libraries to CSRF attacks, allowing attackers to gain access to administrative endpoints

Reporter	Title	Published	Views	Family All 13
CNVD	rails_admin ruby cross-site request forgery vulnerability	17 Jul 201800:00	–	cnvd
CVE	CVE-2016-10522	5 Jul 201816:00	–	cve
Cvelist	CVE-2016-10522	5 Jul 201816:00	–	cvelist
Debian CVE	CVE-2016-10522	5 Jul 201816:00	–	debiancve
EUVD	EUVD-2018-0419	7 Oct 202500:30	–	euvd
Github Security Blog	Cross-site request forgery in rails_admin	8 Aug 201822:30	–	github
NVD	CVE-2016-10522	5 Jul 201816:29	–	nvd
OSV	GHSA-PXQR-8V54-M2HJ Cross-site request forgery in rails_admin	8 Aug 201822:30	–	osv
OSV	UBUNTU-CVE-2016-10522	5 Jul 201816:29	–	osv
Prion	Cross site request forgery (csrf)	5 Jul 201816:29	–	prion

Vulners

Node

-cmsifyMatch0.0.1

-graphiql_railsMatch0.0.2

-cmsifyMatch0.0.1

-graphiql_railsMatch0.0.2

rails_admin_project rails_adminRange≤1.1.0ruby

-reddeRange≤0.3.38

-autherRange≤7.0.0

-browse-everythingRange≤0.11.1

jenkins mission_controlRange≤3.0.0.rc1jenkins

-pages_coreRange≤3.5.1

-activeadmin_jobsRange≤0.1.2

-fae-railsRange≤1.4.1

-virtual_mailsRange≤0.1.2

-mailkickRange≤0.1.6

-searchjoyRange≤0.2.0

-commonwealth-vlr-engineRange≤0.0.7

-postgresql_lo_streamerRange≤1.1.0

-broken_windowRange≤1.1.2

-cambiumRange≤1.3.1

-openstax_accountsRange≤1.0.0

wp_front_end_profile_project wp_front_end_profileRange≤1.0.3wordpress

-simple_form_attachmentsRange≤0.2.6

-lato_viewRange≤1.1.4

-loldesign_publisherRange≤1.3.4

-litRange≤1.1.0

-ndr_errorRange≤1.1.1

-incarnatorRange≤0.0.2.2

-typusRange≤3.1.10

-manageRange≤1.4.3

-rails-i18nterfaceRange≤0.2.6

-webhookerRange≤0.4.0

-mongoid_cartRange≤0.5

-c80_news_tzRange≤0.1.1.26

-udongoRange≤5.6.0

-ecm_pictures2_backendRange≤3.1.0

-erp_tech_svcsRange≤4.2.0

-jive_tilesRange≤0.0.6

-picturesqueRange≤1.0.1

-nyauthRange≤0.7.3

-ingram_micro_engineRange≤0.0.3

-adminableRange≤0.0.7

-buttercms-railsRange≤1.1.1

-rails_email_previewRange≤2.0.2

-push_typeRange≤0.10.4

-mr_videoRange≤1.0.5

-scaffold_picoRange≤1.0.0

Source	Link
sourceclear	www.sourceclear.com/registry/security/cross-site-request-forgery-csrf-/ruby/sid-3173
github	www.github.com/sferik/rails_admin/commit/b13e879eb93b661204e9fb5e55f7afa4f397537a
sourceclear	www.sourceclear.com/blog/rails_admin-vulnerability-disclosure/
sourceclear	www.sourceclear.com/blog/Rails-GEMS-Vulnerable-to-CSRF-Show-Vulnerability-Disclosure-in-Open-Source-Projects-Needs-a-Re-Think/
github	www.github.com/redde/redde/commit/3e5c98abd78af362e0159b6a7a096097c1be7218

30 Jan 2023 03:04Current

8.7High risk

Vulners AI Score8.7

CVSS 26.8

CVSS 38.8

EPSS0.00154