omniauth-oauth2 Cross-Site Request Forgery vulnerability (GHSA-fgmx-8h93-26fh)
Published: 2017-10-24T18:33:37Z
Aliases: CVE-2012-6134
Severity: MODERATE · CWE: CWE-352

Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem prior to 1.1.1 for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.

Affected packages:
package: ecosystem: RubyGems
name: omniauth-oauth2
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.1