{"id":"CVE-2013-4562","aliases":[],"url":"https://o3.security/vulnerability/CVE-2013-4562","summary":"omniauth-facebook Cross-Site Request Forgery vulnerability","details":"The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.","published":"2017-10-24T18:33:37Z","modified":"2024-11-30T05:38:59.133292Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"RubyGems","name":"omniauth-facebook","fixedVersion":"1.5.0"}],"fix":{"url":"https://github.com/mkdynamic/omniauth-facebook/commit/ccfcc26fe7e34acbd75ad4a095fd01ce5ff48ee7","label":"mkdynamic/omniauth-facebook@ccfcc26"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4562"},{"type":"WEB","url":"https://github.com/mkdynamic/omniauth-facebook/commit/ccfcc26fe7e34acbd75ad4a095fd01ce5ff48ee7"},{"type":"PACKAGE","url":"https://github.com/mkdynamic/omniauth-faceboo"},{"type":"WEB","url":"https://groups.google.com/d/msg/ruby-security-ann/-tJHNlTiPh4/9SJxdEWLIawJ"},{"type":"WEB","url":"http://seclists.org/oss-sec/2013/q4/264"},{"type":"WEB","url":"http://seclists.org/oss-sec/2013/q4/267"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-11-30T05:38:59.133292Z"}}