-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| field_test | rubygems | >= 0.2.0, <= 0.3.2 | 0.4.0 |
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability stems from Rails' protect_from_forgery defaulting to :null_session, which only clears the session when CSRF validation fails. Since non-session authentication methods (like HTTP Basic Auth) don't rely on session cookies, this strategy fails to protect them. The fix explicitly sets with: :exception to enforce CSRF token validation regardless of authentication method. The affected code is directly shown in the commit diff modifying BaseController.
Ongoing coverage of React2Shell