Read the docs
TI-2015-03866 Aliases CVE-2015-4619GHSA-2hxv-mx8x-mcj9

Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.

Priority MEDIUM 40CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.

Why it matters now

EPSS 0.00903 59th percentileScored 2026-11-07
Fix Fixed spina (RubyGems): 0.6.29

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—spina (RubyGems)before 0.6.290.6.29Patch availableGHSA-2hxv-mx8x-mcj9
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • spina (RubyGems) Vendor— Affected before 0.6.29 Fixed in 0.6.29 Patch available GHSA-2hxv-mx8x-mcj9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:denkgroot:spina:*:*:*:*:*:*:*:*up to 0.11.1VulnerableDenkgroot
  • cpe:2.3:a:denkgroot:spina:*:*:*:*:*:*:*:* Versions up to 0.11.1 Vulnerable ·Denkgroot

Remediation

  • Fix · GHSA-2hxv-mx8x-mcj9 spina (RubyGems) Fixed in 0.6.29 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-4619
  2. 2026-10-03 Alias added: GHSA-2hxv-mx8x-mcj9

References

Patch 2

Advisory 1

Other 3

  • TI-2024-06581 Spina CMS media_folders cross-site request forgery CVSS 4.0MEDIUM 6.9
  • TI-2024-06547 Spina CMS cross-site request forgery CVSS 4.0MEDIUM 6.9
  • TI-2023-03219 Cross-site Scripting (XSS) - Stored in spinacms/spina CVSS 3.1MEDIUM 4.8
  • TI-2024-27691 Spina CMS v2.18.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the URI /admin/layout. CVSS 3.1CRITICAL 9.6
  • TI-2024-27690 Cross Site Request Forgery vulnerability in Spina CMS v.2.18.0 and before allows a remote… CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences