~ / search / GHSA-v6fx-752r-ccp2

GHSA-v6fx-752r-ccp2

PgHero gem allows CSRF

Source: GitHub Advisory Database (reviewed) High CVE-2020-16253

Packages

EcosystemPackageAffectedFixed in
RubyGems pghero < 2.7.0 2.7.0

Details

As written in the advisory (Markdown source, shown as plain text).

The PgHero gem through 2.6.0 for Ruby allows CSRF. PgHero normally uses the `protect_from_forgery` method from Rails to prevent CSRF. However, this defaults to `:null_session`, which has no effect on non-session based authentication methods. Thus the ruby gem is vulnerable with non-session based authentication methods like basic authentication.

References

External links from the advisory. They lead to third-party sites.