PT-2023-19865 · Rails+1 · Rails+1

Ankane · Publicado 2023-02-02 · Atualizado 2025-03-26 · CVE-2023-25015

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Clockwork Web versions prior to 0.1.2 Rails versions prior to 5.2

Description The issue allows Cross-Site Request Forgery (CSRF) attacks, which work by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs.

Recommendations For Clockwork Web versions prior to 0.1.2, upgrade to version 0.1.2 or later. For Rails versions prior to 5.2, upgrade to version 5.2 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

CWE-652

Identificadores relacionados

CVE-2023-25015

GHSA-P4XX-W6FR-C4W9

Produtos afetados

Clockwork Web

Rails

Referências · 11

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/clockwork_web/CVE-2023-25015.yml · Exploit
• https://github.com/ankane/clockwork_web · Nota
• https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2 · Correção
• https://github.com/ankane/clockwork_web/issues/4 · Nota
• https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857 · Correção
• https://osv.dev/vulnerability/CVE-2023-25015 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25015 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-p4xx-w6fr-c4w9 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25015 · Nota
• https://t.me/cvenotify/116383 · Publicação no Telegram
• https://t.me/cibsecurity/57372 · Publicação no Telegram