VDB
CVE-2008-7248
CVE-2008-7248
PUBLISHED
CVSS 6.800000190734863 MEDIUM
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
EPSS 8.08% · 94.7th percentile
Risk Scores
CVSS 2.0
6.800000190734863
EPSS Score
8.08%
94.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| RubyGems | actionpack | 2.1.0, 2.2.0 |
| n/a | n/a | n/a |
| rubyonrails | rails | 2.1.2, 2.2.0, 2.2.1 |
Timeline
- Dec 14, 2009 PoC Published
- Dec 16, 2009 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Feb 3, 2023 EPSS Score
- Feb 10, 2023 EPSS Score
- Feb 13, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 4, 2023 EPSS Score
References
- http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html url
- ADV-2009-2544 vdb
- http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en url
- [oss-security] 20091128 CVE request: Ruby on Rails: CSRF circumvention (from 2008) mailing-list
- 36600 third-party-advisory
- http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/ url
- http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1 url
- SUSE-SR:2010:006 vendor-advisory
- [oss-security] 20091202 Re: CVE request: Ruby on Rails: CSRF circumvention (from 2008) mailing-list
- 38915 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2008-7248 advisory
- https://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a url
- https://access.redhat.com/security/cve/CVE-2008-7248 url
- https://bugzilla.redhat.com/show_bug.cgi?id=544329 url
- https://github.com/rails/rails package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2008-7248.yml url
- https://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en url
- https://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html url
- https://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup url
- https://web.archive.org/web/20090906010200/https://www.vupen.com/english/advisories/2009/2544 url
…and 5 more