{"action":"Upgrade actionpack to 2.1.3 or later.","affected":[{"fixed":"2.1.3","introduced":"2.1.0"},{"fixed":"2.2.2","introduced":"2.2.0"}],"component":"actionpack","cve_ids":["CVE-2008-7248"],"ecosystem":"RubyGems","epss":0.0808,"exploited":false,"fixed_versions":["2.1.3","2.2.2"],"ghsa_id":"GHSA-8fqx-7pv4-3jwm","id":"tcs_01M5KEJ1E32VAGSRABTDA2X6MS","modified_at":"2024-12-07T05:40:24.463173Z","published_at":"2017-10-24T18:33:38Z","references":["https://osv.dev/vulnerability/GHSA-8fqx-7pv4-3jwm","https://nvd.nist.gov/vuln/detail/CVE-2008-7248","https://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a","https://access.redhat.com/security/cve/CVE-2008-7248","https://bugzilla.redhat.com/show_bug.cgi?id=544329","https://github.com/rails/rails","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2008-7248.yml","https://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en","https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html","https://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup","https://web.archive.org/web/20090906010200/https://www.vupen.com/english/advisories/2009/2544","https://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1","https://www.openwall.com/lists/oss-security/2009/11/28/1","https://www.openwall.com/lists/oss-security/2009/12/02/2","https://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html","http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en","http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html","http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup","http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1","http://www.openwall.com/lists/oss-security/2009/11/28/1","http://www.openwall.com/lists/oss-security/2009/12/02/2"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-8fqx-7pv4-3jwm","url":"https://osv.dev/vulnerability/GHSA-8fqx-7pv4-3jwm"}],"summary":"Improper Input Validation in actionpack"}