NVD

Id
6979  
Name
CVE-2008-7248  
Description
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2009-12-15  
Modified Date
2012-07-06  
Seq
2008-7248  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
39413 6979 CVE-2008-7248 http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en  View
39414 6979 CVE-2008-7248 SUSE-SR:2010:006  View
39415 6979 CVE-2008-7248 http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/  View
39416 6979 CVE-2008-7248 http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1  View
39417 6979 CVE-2008-7248 [oss-security] 20091128 CVE request: Ruby on Rails: CSRF circumvention (from 2008)  View
39418 6979 CVE-2008-7248 [oss-security] 20091202 Re: CVE request: Ruby on Rails: CSRF circumvention (from 2008)  View
39419 6979 CVE-2008-7248 http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html  View
39420 6979 CVE-2008-7248 ADV-2009-2544  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
51332 JVNDB-2008-006642 Ruby on Rails におけるクロスサイトリクエストフォージェリ (CSRF) 保護を回避される脆弱性 Ruby on Rails は、特定のコンテンツタイプを伴うリクエストに対してトークンを確認しないため、クロスサイトリクエストフォージェリ (CSRF) 保護機能に依存するアプリケーションへのリクエストに対する CSRF 保護を回避される脆弱性が存在します。 CVE-2008-7248 37361 CVE-2008-7248 6979 6.8 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-006642.html 2008-11-18 2012-12-20 View