CVE-2013-4562
omniauth-facebook Cross-Site Request Forgery vulnerability
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
Exploit likelihood
What each source reports
NVD Score used
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
- Record
CVE-2013-4562- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
- Record
CVE-2013-4562- Updated
- 2026-11-02
EUVDEUVD-2017-0216 No score
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
- Record
EUVD-2017-0216- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cf36-985g-v73c No score
omniauth-facebook Cross-Site Request Forgery vulnerability
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
- Record
GHSA-cf36-985g-v73c- Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-cf36-985g-v73c No score
omniauth-facebook Cross-Site Request Forgery vulnerability
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
- Record
GHSA-cf36-985g-v73c- Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
omniauth-facebookRubyGems |
1.4.1 up to 1.5.0 | 1.5.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4562 is a medium vulnerability (CVSS 6.8) in Madeofcode Omniauth-facebook, published May 13, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.17%, the 67th percentile. Fixed in omniauth-facebook 1.5.0.
References
seclists.org/oss-sec/2013/q4/264
osvdb.org/99693
github.com/mkdynamic/omniauth-facebook/commit/ccfcc26fe7e34acbd75ad4a095fd01ce5ff48ee7
groups.google.com/d/msg/ruby-security-ann/-tJHNlTiPh4/9SJxdEWLIawJ
osvdb.org/ref/99/omniauth-facebook_gem.txt
nvd.nist.gov/vuln/detail/CVE-2013-4562