~ / search / GHSA-p4xx-w6fr-c4w9

GHSA-p4xx-w6fr-c4w9

Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-25015

Packages

EcosystemPackageAffectedFixed in
RubyGems clockwork_web < 0.1.2 0.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

Clockwork Web before 0.1.2, when used with Rails before 5.2 is used, allows Cross-Site Request Forgery (CSRF). A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs. All users running an affected release on Rails < 5.2 should upgrade immediately.

References

External links from the advisory. They lead to third-party sites.