{"action":"Upgrade omniauth to 2.0.0 or later.","affected":[{"fixed":"2.0.0","introduced":"0"}],"component":"omniauth","cve_ids":["CVE-2015-9284"],"ecosystem":"RubyGems","epss":0.01525,"exploited":false,"fixed_versions":["2.0.0"],"ghsa_id":"GHSA-ww4x-rwq6-qpgf","id":"tcs_01M5KEP1EYWQDZ8MN79HB4BE9H","modified_at":"2024-02-16T08:21:54.381778Z","published_at":"2019-05-29T19:11:31Z","references":["https://osv.dev/vulnerability/GHSA-ww4x-rwq6-qpgf","https://nvd.nist.gov/vuln/detail/CVE-2015-9284","https://github.com/omniauth/omniauth/issues/1031","https://github.com/omniauth/omniauth-rails/pull/1","https://github.com/omniauth/omniauth/pull/809","https://github.com/rubysec/ruby-advisory-db/commit/aef9f623c0be838234d53baf18977564804da397","https://github.com/omniauth/omniauth","https://github.com/omniauth/omniauth/releases/tag/v1.9.2","https://github.com/omniauth/omniauth/releases/tag/v2.0.0","https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth/CVE-2015-9284.yml","https://www.openwall.com/lists/oss-security/2015/05/26/11"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-ww4x-rwq6-qpgf","url":"https://osv.dev/vulnerability/GHSA-ww4x-rwq6-qpgf"}],"summary":"OmniAuth Ruby gem Cross-site Request Forgery in request phase"}