Headline
GHSA-p4xx-w6fr-c4w9: Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2
Clockwork Web before 0.1.2, when used with Rails before 5.2 is used, allows Cross-Site Request Forgery (CSRF). A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs. All users running an affected release on Rails < 5.2 should upgrade immediately.
Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2
Moderate severity GitHub Reviewed Published Feb 2, 2023 to the GitHub Advisory Database • Updated Feb 2, 2023
Related news
CVE-2023-25015: Fixed CSRF vulnerability with Rails < 5.2 · ankane/clockwork_web@ec28965
Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.