RubyGems/omniauth-oauth2 CVE-2012-6134: medium, EPSS 1.20%

omniauth-oauth2 Cross-Site Request Forgery vulnerability

Action: Upgrade omniauth-oauth2 to 1.1.1 or later.

bundle update omniauth-oauth2

Affected

Fixed versions

Sources

• osv: GHSA-fgmx-8h93-26fh
• https://nvd.nist.gov/vuln/detail/CVE-2012-6134
• https://github.com/Shopify/omniauth-shopify-oauth2/pull/1
• https://github.com/intridea/omniauth-oauth2/pull/25
• https://github.com/Shopify/omniauth-shopify-oauth2
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-oauth2/CVE-2012-6134.yml
• https://web.archive.org/web/20170312020947/https://gist.github.com/homakov/3673012
• http://rubysec.github.io/advisories/CVE-2012-6134
• http://seclists.org/oss-sec/2013/q1/304

CVE-2012-6134 · published 2017-10-24T18:33:37Z · modified 2024-12-05T05:39:59.934310Z · JSON