QwikSec

Security Database

CVE

CWE

Training

CVE-2008-7248

Published: Dec 16, 2009

Modified: Aug 7, 2024

PUBLISHED

Description

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

[oss-security] 20091128 CVE request: Ruby on Rails: CSRF circumvention (from 2008)

mailing-list

x_refsource_MLIST

http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html

x_refsource_MISC

third-party-advisory

x_refsource_SECUNIA

http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/

x_refsource_MISC

http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1

x_refsource_CONFIRM

vdb-entry

x_refsource_VUPEN

http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en

x_refsource_MISC

SUSE-SR:2010:006

vendor-advisory

x_refsource_SUSE

[oss-security] 20091202 Re: CVE request: Ruby on Rails: CSRF circumvention (from 2008)

mailing-list

x_refsource_MLIST

third-party-advisory

x_refsource_SECUNIA

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.