Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/rails/rails ↗ | |
| All commits before 7b5cc5a5dfcf38522be0a4b5daa97c5b2ba26c20 | 7b5cc5a5dfcf38522be0a4b5daa97c5b2ba26c20 |
| 66cabeda2c46c582d19738e1318be8d59584cc5b to before 34991a6ae2fc68347c01ea7382fa89004159e019 | 34991a6ae2fc68347c01ea7382fa89004159e019 |
Also listed as affected (44)
| |
Description
A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.