CVE-2015-9284: omniauth Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2015-9284 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in omniauth. EPSS estimates a 1.52% chance of exploitation in the next 30 days, higher than 74.2% of scored vulnerabilities.
Timeline
- 26-04-2019PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · RubygemsEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.52%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
-0.05 pp
From 1.57% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- ruby-omniauth< 2.0.4-2
Omniauth1 product
- omniauth< 2.0.0
RubyGems1 product
- omniauth< 2.0.0
Ubuntu1 product
- ruby-omniauthAll versions (No fix recorded)
4 vendors · 4 products
References
14 links- www.openwall.com/lists/oss-security/2015/05/26/11Mailing ListX Refsource MLISTPatchThird Party AdvisoryREPORTWEB
- github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284X Refsource MISCMitigationThird Party AdvisoryWEB
