CVE-2013-4562
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- madeofcode:omniauth-facebook
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cf36-985g-v73c | RubyGems | omniauth-facebook | >=1.4.1 <1.5.0 | 1.5.0 |