CVE-2023-25015: Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2
(updated )
Clockwork Web before 0.1.2, when used with Rails before 5.2 is used, allows Cross-Site Request Forgery (CSRF). A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs. All users running an affected release on Rails < 5.2 should upgrade immediately.
References
- github.com/advisories/GHSA-p4xx-w6fr-c4w9
- github.com/ankane/clockwork_web
- github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857
- github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2
- github.com/ankane/clockwork_web/issues/4
- github.com/rubysec/ruby-advisory-db/blob/master/gems/clockwork_web/CVE-2023-25015.yml
- nvd.nist.gov/vuln/detail/CVE-2023-25015
Code Behaviors & Features
Detect and mitigate CVE-2023-25015 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →