Vulnerabilities

TI-2020-18798 CVE-2020-36599 · GHSA-pm55-qfxr-h247

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

MEDIUM 44

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01198 Published 2022-08-18 Fixed in 1.9.2, 2.0.0 CWE-116

TI-2015-07661 CVE-2015-9284 · GHSA-ww4x-rwq6-qpgf

Cross-site request forgery in omniauth ruby gem

MEDIUM 41

The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user int…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01525 Published 2019-04-26 Partial fix · 2.0.0 CWE-352

TI-2017-13284 CVE-2017-18076 · GHSA-9pr6-grf4-x2fr

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly…

LOW 37

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02129 Published 2018-01-26 Fixed in 1.3.2

Vulnerabilities

Filters

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

Cross-site request forgery in omniauth ruby gem

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly…