PT-2017-6770 · Spina · Spina

Published 2017-09-07 · Updated 2018-08-28 · CVE-2015-4619

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spina versions prior to commit bfe44f289e336f80b6593032679300c493735e75

Description The issue is a cross-site request forgery (CSRF) vulnerability. It affects the Spina::ApplicationController actions, which lacked CSRF protection. This results in a CSRF vulnerability across the entire engine, including administrative functionality such as creating users, changing passwords, and media management.

Recommendations For versions prior to commit bfe44f289e336f80b6593032679300c493735e75, update to a version that includes the fix for this issue. As a temporary workaround, consider implementing CSRF protection for Spina::ApplicationController actions to minimize the risk of exploitation. Restrict access to administrative functionality, such as creating users, changing passwords, and media management, until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-4619

GHSA-2HXV-MX8X-MCJ9

Affected Products

Spina

References · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spina/CVE-2015-4619.yml · Exploit
• https://github.com/denkGroot/Spina/commit/bfe44f289e336f80b6593032679300c493735e75 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-4619 · Security Note
• http://openwall.com/lists/oss-security/2015/06/16/20 · Patch
• https://osv.dev/vulnerability/GHSA-2hxv-mx8x-mcj9 · Vendor Advisory
• https://github.com/denkGroot/Spina · Note
• http://securityfocus.com/bid/75216 · Note
• http://openwall.com/lists/oss-security/2015/06/16/11 · Note