CVE-2012-6134

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.20%

Published

Apr 9, 2013

Modified

Apr 28, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.

Weaknesses (CWE)

CWE-352

Affected Products (1)

omniauth-oauth2_project · omniauth-oauth2 (up to 1.1.1)vulnerable

References (10)

http://rubysec.github.io/advisories/CVE-2012-6134/

Broken Link

http://seclists.org/oss-sec/2013/q1/304

Mailing ListThird Party Advisory

https://gist.github.com/homakov/3673012

Broken Link

https://github.com/Shopify/omniauth-shopify-oauth2/pull/1

PatchThird Party Advisory

https://github.com/intridea/omniauth-oauth2/pull/25

PatchThird Party Advisory

http://rubysec.github.io/advisories/CVE-2012-6134/

Broken Link

http://seclists.org/oss-sec/2013/q1/304

Mailing ListThird Party Advisory

https://gist.github.com/homakov/3673012

Broken Link

https://github.com/Shopify/omniauth-shopify-oauth2/pull/1

PatchThird Party Advisory

https://github.com/intridea/omniauth-oauth2/pull/25

PatchThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs