CVE-2023-25015
Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2
Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.
- Record
CVE-2023-25015- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352, CWE-652
- Updated
- 2026-11-02
CVE List
Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.
- Record
CVE-2023-25015- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-652
- Updated
- 2026-11-02
EUVDEUVD-2023-0750
Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.
- Record
EUVD-2023-0750- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p4xx-w6fr-c4w9
Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2
Clockwork Web before 0.1.2, when used with Rails before 5.2 is used, allows Cross-Site Request Forgery (CSRF). A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs. All users running an affected release on Rails < 5.2 should upgrade immediately.
- Record
GHSA-p4xx-w6fr-c4w9- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352, CWE-652
- Updated
- 2026-11-02
OSV
Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.
- Record
CVE-2023-25015- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-p4xx-w6fr-c4w9
Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2
Clockwork Web before 0.1.2, when used with Rails before 5.2 is used, allows Cross-Site Request Forgery (CSRF). A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs. All users running an affected release on Rails < 5.2 should upgrade immediately.
- Record
GHSA-p4xx-w6fr-c4w9- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-352, CWE-652
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
clockwork_webRubyGems |
before 0.1.2 | 0.1.2 |
clockwork_webRubyGems |
before 0.1.2, plus listed versions 0.0.10.0.20.0.30.0.40.0.50.1.00.1.1 |
0.1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-25015 is a medium vulnerability (CVSS 6.5) in Clockwork Web Project Web, published February 2, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in clockwork_web 0.1.2.
References
github.com/ankane/clockwork_web/issues/4
nvd.nist.gov/vuln/detail/CVE-2023-25015