HIGH8.8

GHSA-2hxv-mx8x-mcj9

Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability

Quick fix

GHSA-2hxv-mx8x-mcj9 — spina: upgrade to the fixed version with the command below.

bundle update spina

Details

Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75. `Spina::ApplicationController` actions didn't have CSRF protection. This causes a CSRF vulnerability across the entire engine which includes administrative functionality such as creating users, changing passwords, and media management.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/spina

Introduced in: 0Fixed in: 0.6.29

Fixbundle update spina

References

https://nvd.nist.gov/vuln/detail/CVE-2015-4619[ADVISORY]
https://github.com/denkGroot/Spina/commit/bfe44f289e336f80b6593032679300c493735e75[WEB]
https://github.com/denkGroot/Spina[PACKAGE]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spina/CVE-2015-4619.yml[WEB]
http://www.openwall.com/lists/oss-security/2015/06/16/11[WEB]
http://www.openwall.com/lists/oss-security/2015/06/16/20[WEB]
http://www.securityfocus.com/bid/75216[WEB]