{"id":"CVE-2023-25015","aliases":["EUVD-2023-0750","GHSA-p4xx-w6fr-c4w9"],"status":"published","title":"Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails \u003c 5.2","description":"Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00358,"percentile":0.29838,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352","CWE-652"],"published":"2023-02-02T00:00:00Z","modified":"2026-10-28T02:30:22Z","fixes":[{"ecosystem":"RubyGems","package":"clockwork_web","fixed_in":["0.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"clockwork_web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"clockwork_web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.1.0","0.1.1"]}],"products":[{"vendor":"clockwork_web_project","product":"clockwork_web"}],"references":[{"url":"https://github.com/ankane/clockwork_web/issues/4","tags":["x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25015","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/clockwork_web/CVE-2023-25015.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p4xx-w6fr-c4w9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25015.json","tags":["advisory"]},{"url":"https://github.com/ankane/clockwork_web","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-25015","description":"Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.","status":"published","published":"2023-02-02T00:00:00Z","modified":"2025-03-26T17:35:33.917Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-652"],"updated_at":"2026-11-02T14:35:19.559321Z"}],"euvd":[{"id":"EUVD-2023-0750","description":"Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.","status":"published","published":"2023-02-02T00:00:00Z","modified":"2025-03-26T17:35:33Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:50.922534Z"}],"ghsa":[{"id":"GHSA-p4xx-w6fr-c4w9","title":"Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails \u003c 5.2","description":"Clockwork Web before 0.1.2, when used with Rails before 5.2 is used, allows Cross-Site Request Forgery (CSRF). A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs. All users running an affected release on Rails \u003c 5.2 should upgrade immediately.","status":"published","published":"2023-02-02T06:30:26Z","modified":"2025-03-26T19:49:08Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352","CWE-652"],"updated_at":"2026-11-02T14:38:36.51789Z"}],"nvd":[{"id":"CVE-2023-25015","description":"Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.","status":"published","published":"2023-02-02T04:15:08.107Z","modified":"2026-06-17T05:40:29.67Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352","CWE-652"],"updated_at":"2026-11-02T14:07:46.064662Z"}],"osv":[{"id":"CVE-2023-25015","description":"Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.","status":"published","published":"2023-02-02T00:00:00Z","modified":"2026-10-28T02:30:22.154899761Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"GHSA-p4xx-w6fr-c4w9","title":"Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails \u003c 5.2","description":"Clockwork Web before 0.1.2, when used with Rails before 5.2 is used, allows Cross-Site Request Forgery (CSRF). A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs. All users running an affected release on Rails \u003c 5.2 should upgrade immediately.","status":"published","published":"2023-02-02T06:30:26Z","modified":"2025-03-26T20:03:04.44416Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352","CWE-652"],"updated_at":"2026-11-02T15:46:52.534897Z"}]}}