CVE

Id
37365  
CVE No.
CVE-2008-7248  
Status
Candidate  
Description
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.  
Phase
Assigned (20091211)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
405202 37365 CVE-2008-7248 MLIST:[oss-security] 20091128 CVE request: Ruby on Rails: CSRF circumvention (from 2008)  View
405203 37365 CVE-2008-7248 URL:http://www.openwall.com/lists/oss-security/2009/11/28/1  View
405204 37365 CVE-2008-7248 MLIST:[oss-security] 20091202 Re: CVE request: Ruby on Rails: CSRF circumvention (from 2008)  View
405205 37365 CVE-2008-7248 URL:http://www.openwall.com/lists/oss-security/2009/12/02/2  View
405206 37365 CVE-2008-7248 MISC:http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en  View
405207 37365 CVE-2008-7248 MISC:http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/  View
405208 37365 CVE-2008-7248 MISC:http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html  View
405209 37365 CVE-2008-7248 CONFIRM:http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1  View
405210 37365 CVE-2008-7248 SUSE:SUSE-SR:2010:006  View
405211 37365 CVE-2008-7248 URL:http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html  View
405212 37365 CVE-2008-7248 SECUNIA:36600  View
405213 37365 CVE-2008-7248 URL:http://secunia.com/advisories/36600  View
405214 37365 CVE-2008-7248 SECUNIA:38915  View
405215 37365 CVE-2008-7248 URL:http://secunia.com/advisories/38915  View
405216 37365 CVE-2008-7248 VUPEN:ADV-2009-2544  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
39243 JVNDB-2010-005028 phpMyAdmin の libraries/File.class.php における脆弱性 phpMyAdmin の libraries/File.class.php は、テンポラリファイルに対する予測可能なファイル名を使用するため、不特定の影響を受ける脆弱性が存在します。 CVE-2008-7252 37365 10 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-005028.html  View