Description

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.

Remediation

References

CVE-2008-7248

Related Vulnerabilities

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-1875)

WordPress 4.2.x Arbitrary File Deletion Vulnerability (4.2 - 4.2.20)

e107 Other Vulnerability (CVE-2005-3521)

Dot CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-16980)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-9059)

Severity

Medium

Classification

CVE-2008-7248 CWE-20

Tags

Missing Update Known Vulnerabilities