CVE-2016-10522 Cross-site request forgery in rails_admin
Attackers can perform unauthorized administrative actions via CSRF due to missing token validation in non-GET requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-10522?
CVE-2016-10522 is a high-severity vulnerability in https://github.com/sferik rails_admin ruby gem, published on 5 Jul 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
Weakness: CWE-352
Which versions are affected by CVE-2016-10522?
2 open source packages ship an affected version, including rails_admin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rails_admin RubyGems | From 1.0.0 | 1.1.1 |
rails_admin RubyGems | From 1.0.0 | 1.1.1 |
Products include Rails Admin Project Rails Admin.
How do I fix CVE-2016-10522?
Upgrade rails_admin to 1.1.1 or later.
Is CVE-2016-10522 being exploited?
There is no known exploitation of CVE-2016-10522 in the wild and no public exploit code.
Other vulnerabilities in https://github.com/sferik rails_admin ruby gem
Sources
Also known as GHSA-pxqr-8v54-m2hj, UBUNTU-CVE-2016-10522.