CVE-2012-6134

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-04-09 · updated 2026-06-16
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.

Affected products

Omniauth-Oauth2 Project Omniauth-Oauth2: before 1.1.1 — fixed in 1.1.1

How to fix

Upgrade to a fixed version: Omniauth-Oauth2 Project Omniauth-Oauth2 1.1.1. Check the vendor advisory for mitigations.

References

http://rubysec.github.io/advisories/CVE-2012-6134/
http://seclists.org/oss-sec/2013/q1/304
https://gist.github.com/homakov/3673012
https://github.com/Shopify/omniauth-shopify-oauth2/pull/1
https://github.com/intridea/omniauth-oauth2/pull/25
http://rubysec.github.io/advisories/CVE-2012-6134/
http://seclists.org/oss-sec/2013/q1/304
https://gist.github.com/homakov/3673012
https://github.com/Shopify/omniauth-shopify-oauth2/pull/1
https://github.com/intridea/omniauth-oauth2/pull/25

Get alerted when CVE-2012-6134 or the next vulnerability affects your stack