Detections
Analytics

CVE-2013-4562

high

Description

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.

References

https://groups.google.com/d/msg/ruby-security-ann/-tJHNlTiPh4/9SJxdEWLIawJ

http://www.osvdb.org/99693

http://seclists.org/oss-sec/2013/q4/267

http://seclists.org/oss-sec/2013/q4/264

http://osvdb.org/ref/99/omniauth-facebook_gem.txt

Details

Source: Mitre, NVD

Published: 2014-05-13

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00481