Ruby on Rails 2.1 prior to 2.1.3 and 2.2.x prior to 2.2.2 does not verify tokens for requests with certain content types, which allows remote malicious users to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
rubyonrails rails 2.1.0 |
||
rubyonrails rails 2.1.1 |
||
rubyonrails rails 2.1.2 |
||
rubyonrails rails 2.2.0 |
||
rubyonrails rails 2.2.1 |
Vulmon