Cross-site request forgery in rails_admin

Also known as GHSA-pxqr-8v54-m2hj

Published 8 y ago 2018-07-05 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.0%

percentile 62%

Public exploits

none known

rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.

Exploit prediction (EPSS)

0.98% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`
GitHub	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
rubygems	`rails_admin`	>=1.0.0, <1.1.1	1.1.1

Affected products

https://github.com/sferik rails_admin ruby gem

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

sourceclear.com /blog/Rails_admin-Vulnerability-Disclosure/ · x_refsource_MISC, x_transferred
github.com /sferik/rails_admin/commit/b13e879eb93b661204e9fb5e55f7afa4f397537a · x_refsource_CONFIRM, x_transferred
sourceclear.com /registry/security/cross-site-request-forgery-csrf-/ruby/sid-3173 · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-10522 · advisory
github.com /railsadminteam/rails_admin/commit/b13e879eb93b661204e9fb5e55f7afa4f397537a · web
github.com /advisories/GHSA-pxqr-8v54-m2hj · advisory
github.com /railsadminteam/rails_admin · package
github.com /rubysec/ruby-advisory-db/blob/master/gems/rails_admin/CVE-2016-10522.yml · web

Sources

CVE List: CVE-2016-10522
GitHub Advisory: GHSA-pxqr-8v54-m2hj
NVD: CVE-2016-10522

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary