CVE-2008-7248
Improper Input Validation in actionpack
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
Exploit likelihood
What each source reports
NVD Score used
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
- Record
CVE-2008-7248- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
- Record
CVE-2008-7248- Updated
- 2026-11-02
EUVDEUVD-2017-0192 No score
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
- Record
EUVD-2017-0192- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8fqx-7pv4-3jwm No score
Improper Input Validation in actionpack
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
- Record
GHSA-8fqx-7pv4-3jwm- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
- Record
CVE-2008-7248- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-7248 No score
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
- Record
DEBIAN-CVE-2008-7248- Updated
- 2026-11-02
OSVGHSA-8fqx-7pv4-3jwm No score
Improper Input Validation in actionpack
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
- Record
GHSA-8fqx-7pv4-3jwm- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actionpackRubyGems |
2.1.0 up to 2.1.3 | 2.1.3 |
actionpackRubyGems |
2.2.0 up to 2.2.2 | 2.2.2 |
railsDebian:12 |
before 2.2.3-1 | 2.2.3-1 |
railsDebian:13 |
before 2.2.3-1 | 2.2.3-1 |
railsDebian:14 |
before 2.2.3-1 | 2.2.3-1 |
actionpackRubyGems |
2.1.0 up to 2.1.3, plus listed versions 2.1.12.1.2 |
2.1.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Ruby on Rails 2.3.5 - 'protect_from_forgery' Cross-Site Request Forgery | 2009-12-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-7248 is a medium vulnerability (CVSS 6.8) in Rubyonrails Rails, published December 16, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.08%, the 94th percentile. Fixed in actionpack 2.1.3.
References
openwall.com/lists/oss-security/2009/11/28/1
rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html
secunia.com/advisories/36600
pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup
weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
vupen.com/english/advisories/2009/2544
Show 13 moreShow less
groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en
lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
nvd.nist.gov/vuln/detail/CVE-2008-7248
access.redhat.com/security/cve/CVE-2008-7248
bugzilla.redhat.com/show_bug.cgi?id=544329
github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2008-7248.yml
web.archive.org/web/20090906010200/https://www.vupen.com/english/advisories/2009/2544
security-tracker.debian.org/tracker/CVE-2008-7248