CVE-2016-10522

NONE EPSS 58.0%

Published Jul 5, 20188y ago · Modified Jun 17, 20262w ago

Published Jul 5, 2018 8y ago

Last Modified Jun 17, 2026 2w ago

Description

rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.

Threat Intelligence

EPSS Exploit Probability

58.0% percentile

Exploit & Patch Status

Public Exploit Known

Patch Available

Weaknesses 1

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

Affected Products 1

Vendor	Product	Version	Range
rails_admin_project	rails_admin	*	<1.1.1

References 3

github.com https://github.com/sferik/rails_admin/commit/b13e879eb93b661204e9fb5e55f7afa4f397537a

PatchThird Party Advisory
sourceclear.com https://www.sourceclear.com/blog/Rails_admin-Vulnerability-Disclosure/

ExploitPatchThird Party Advisory
sourceclear.com https://www.sourceclear.com/registry/security/cross-site-request-forgery-csrf-/ruby/sid-3173

ExploitPatchThird Party Advisory

Remediation

github.com https://github.com/sferik/rails_admin/commit/b13e879eb93b661204e9fb5e55f7afa4f397537a

PatchThird Party Advisory
sourceclear.com https://www.sourceclear.com/blog/Rails_admin-Vulnerability-Disclosure/

ExploitPatchThird Party Advisory
sourceclear.com https://www.sourceclear.com/registry/security/cross-site-request-forgery-csrf-/ruby/sid-3173

ExploitPatchThird Party Advisory