PT-2023-19865 · Rails+1 · Rails+1

Ankane · Published 2023-02-02 · Updated 2025-03-26 · CVE-2023-25015

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Clockwork Web versions prior to 0.1.2 Rails versions prior to 5.2

Description The issue allows Cross-Site Request Forgery (CSRF) attacks, which work by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs.

Recommendations For Clockwork Web versions prior to 0.1.2, upgrade to version 0.1.2 or later. For Rails versions prior to 5.2, upgrade to version 5.2 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

CWE-652

Related Identifiers

CVE-2023-25015

GHSA-P4XX-W6FR-C4W9

Affected Products

Clockwork Web

Rails

References · 11

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/clockwork_web/CVE-2023-25015.yml · Exploit
• https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2 · Patch
• https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857 · Patch
• https://osv.dev/vulnerability/CVE-2023-25015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25015 · Security Note
• https://osv.dev/vulnerability/GHSA-p4xx-w6fr-c4w9 · Vendor Advisory
• https://github.com/ankane/clockwork_web · Note
• https://github.com/ankane/clockwork_web/issues/4 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25015 · Note
• https://t.me/cvenotify/116383 · Telegram Post
• https://t.me/cibsecurity/57372 · Telegram Post