{"id":"CVE-2012-6134","aliases":["EUVD-2017-0228","GHSA-fgmx-8h93-26fh"],"status":"published","title":"omniauth-oauth2 Cross-Site Request Forgery vulnerability","description":"Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01196,"percentile":0.683,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2013-04-09T20:00:00Z","modified":"2026-06-16T23:47:53Z","fixes":[{"ecosystem":"RubyGems","package":"omniauth-oauth2","fixed_in":["1.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"omniauth-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"omniauth-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}],"versions":["1.0.0","1.0.0.beta1","1.0.0.pr1","1.0.0.pr2","1.0.0.rc1","1.0.0.rc2","1.0.1","1.0.2","1.0.3","1.1.0"]}],"products":[{"vendor":"omniauth-oauth2_project","product":"omniauth-oauth2"}],"references":[{"url":"https://github.com/Shopify/omniauth-shopify-oauth2/pull/1","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://github.com/intridea/omniauth-oauth2/pull/25","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","web"]},{"url":"http://rubysec.github.io/advisories/CVE-2012-6134/","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"https://gist.github.com/homakov/3673012","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://seclists.org/oss-sec/2013/q1/304","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6134","tags":["advisory"]},{"url":"https://web.archive.org/web/20170312020947/https://gist.github.com/homakov/3673012","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth-oauth2/CVE-2012-6134.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fgmx-8h93-26fh"},{"url":"https://github.com/Shopify/omniauth-shopify-oauth2","tags":["package"]},{"url":"http://rubysec.github.io/advisories/CVE-2012-6134","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-6134","description":"Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.","status":"published","published":"2013-04-09T20:00:00Z","modified":"2024-09-17T00:42:34.768Z","updated_at":"2026-11-02T14:34:51.269982Z"}],"euvd":[{"id":"EUVD-2017-0228","description":"Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.","status":"published","published":"2013-04-09T20:00:00Z","modified":"2024-09-17T00:42:34Z","updated_at":"2026-11-03T00:28:56.465986Z"}],"ghsa":[{"id":"GHSA-fgmx-8h93-26fh","title":"omniauth-oauth2 Cross-Site Request Forgery vulnerability","description":"Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem prior to 1.1.1 for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2023-08-29T10:55:49Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2012-6134","description":"Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.","status":"published","published":"2013-04-09T20:55:01.6Z","modified":"2026-06-16T23:47:53.187Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:02:17.375282Z"}],"osv":[{"id":"GHSA-fgmx-8h93-26fh","title":"omniauth-oauth2 Cross-Site Request Forgery vulnerability","description":"Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem prior to 1.1.1 for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2024-12-05T05:39:59.93431Z","cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:46.39441Z"}]}}