CVE-2016-10522
Cross-site request forgery in rails_admin
CVE-2016-10522 is a high vulnerability (CVSS 8.8) in Rails Admin Project Admin, published July 5, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in rails_admin 1.1.1.
- Severity
- 8.8 HighCVSS 3.0, NVD
- Exploit chance
- 0.97%EPSS, 62nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.1.1rails_admin +3 more
Description
rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rails_adminRubyGems | 1.0.0 up to 1.1.1 | 1.1.1 |
rails_adminRubyGems | 1.0.0 up to 1.1.1, plus listed versions 1.1.0 | 1.1.1 |
ruby-rails-adminUbuntu:16.04:LTS | All versions, plus listed versions 0.6.8~dfsg-10.7.0~dfsg-2 | None known |
ruby-rails-adminUbuntu:18.04:LTS | All versions, plus listed versions 0.8.1+dfsg-3 | None known |
What each source reports
NVD Score used
rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
- Record
CVE-2016-10522- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE ListNo score
rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
- Record
CVE-2016-10522- Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2018-0419No score
rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
- Record
EUVD-2018-0419- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pxqr-8v54-m2hj
Cross-site request forgery in rails_admin
rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
- Record
GHSA-pxqr-8v54-m2hj- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
- Record
CVE-2016-10522- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-pxqr-8v54-m2hj
Cross-site request forgery in rails_admin
rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
- Record
GHSA-pxqr-8v54-m2hj- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10522
rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
- Record
UBUNTU-CVE-2016-10522- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
sourceclear.com/blog/Rails_admin-Vulnerability-Disclosure
github.com/sferik/rails_admin/commit/b13e879eb93b661204e9fb5e55f7afa4f397537a
nvd.nist.gov/vuln/detail/CVE-2016-10522