Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CSRF Vulnerability #4

Closed
ankane opened this issue Feb 2, 2023 · 0 comments
Closed

CSRF Vulnerability #4

ankane opened this issue Feb 2, 2023 · 0 comments

Comments

@ankane
Copy link
Owner

ankane commented Feb 2, 2023

Clockwork Web is vulnerable to cross-site request forgery (CSRF) with Rails < 5.2. This vulnerability has been assigned the CVE identifier CVE-2023-25015.

Versions Affected: 0.1.1 and below
Fixed Versions: 0.1.2

Impact

Clockwork Web is vulnerable to cross-site request forgery (CSRF) with Rails < 5.2.

A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs.

All users running an affected release on Rails < 5.2 should upgrade immediately.
@ankane ankane mentioned this issue Feb 2, 2023
Merged
@ankane ankane closed this as completed Feb 2, 2023
Repository owner locked and limited conversation to collaborators Feb 2, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@ankane