Vulnerability-Lookup

GHSA-P4XX-W6FR-C4W9

Vulnerability from github – Published: 2023-02-02 06:30 – Updated: 2025-03-26 19:49

Summary

Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2

Details

Clockwork Web before 0.1.2, when used with Rails before 5.2 is used, allows Cross-Site Request Forgery (CSRF). A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs. All users running an affected release on Rails < 5.2 should upgrade immediately.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "clockwork_web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-25015"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352",
      "CWE-652"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-02T23:07:04Z",
    "nvd_published_at": "2023-02-02T04:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Clockwork Web before 0.1.2, when used with Rails before 5.2 is used, allows Cross-Site Request Forgery (CSRF). A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs. All users running an affected release on Rails \u003c 5.2 should upgrade immediately.",
  "id": "GHSA-p4xx-w6fr-c4w9",
  "modified": "2025-03-26T19:49:06Z",
  "published": "2023-02-02T06:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25015"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ankane/clockwork_web/issues/4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ankane/clockwork_web"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/clockwork_web/CVE-2023-25015.yml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails \u003c 5.2"
}

CVE-2023-25015 (GCVE-0-2023-25015)

Vulnerability from cvelistv5 – Published: 2023-02-02 00:00 – Updated: 2025-03-26 17:35

Summary

Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

n/a
CWE-652 - Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')

Assigner

mitre

References

3 references

URL	Tags
https://github.com/ankane/clockwork_web/issues/4
https://github.com/ankane/clockwork_web/compare/v…
https://github.com/ankane/clockwork_web/commit/ec…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:11:43.547Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ankane/clockwork_web/issues/4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-25015",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-26T17:34:46.371943Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-652",
                "description": "CWE-652 Improper Neutralization of Data within XQuery Expressions (\u0027XQuery Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-26T17:35:33.917Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-02T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/ankane/clockwork_web/issues/4"
        },
        {
          "url": "https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2"
        },
        {
          "url": "https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-25015",
    "datePublished": "2023-02-02T00:00:00.000Z",
    "dateReserved": "2023-02-02T00:00:00.000Z",
    "dateUpdated": "2025-03-26T17:35:33.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GSD-2023-25015

Vulnerability from gsd - Updated: 2023-02-01 00:00

Details

Clockwork Web is vulnerable to cross-site request forgery (CSRF) with Rails < 5.2. A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs.

Aliases

CVE-2023-25015

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-25015",
    "id": "GSD-2023-25015"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "clockwork_web",
            "purl": "pkg:gem/clockwork_web"
          }
        }
      ],
      "aliases": [
        "CVE-2023-25015",
        "GHSA-p4xx-w6fr-c4w9"
      ],
      "details": "Clockwork Web is vulnerable to cross-site request forgery (CSRF) with Rails \u003c 5.2.\n\nA CSRF attack works by getting an authorized user to visit a malicious website and\nthen performing requests on behalf of the user. In this instance, actions include\nenabling and disabling jobs.\n",
      "id": "GSD-2023-25015",
      "modified": "2023-02-01T00:00:00.000Z",
      "published": "2023-02-01T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/ankane/clockwork_web/issues/4"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 6.5,
          "type": "CVSS_V3"
        }
      ],
      "summary": "CSRF Vulnerability with Rails \u003c 5.2"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2023-25015",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/ankane/clockwork_web/issues/4",
            "refsource": "CONFIRM",
            "url": "https://github.com/ankane/clockwork_web/issues/4"
          },
          {
            "name": "https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2",
            "refsource": "MISC",
            "url": "https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2"
          },
          {
            "name": "https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857",
            "refsource": "MISC",
            "url": "https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2023-25015",
      "cvss_v3": 6.5,
      "date": "2023-02-01",
      "description": "Clockwork Web is vulnerable to cross-site request forgery (CSRF) with Rails \u003c 5.2.\n\nA CSRF attack works by getting an authorized user to visit a malicious website and\nthen performing requests on behalf of the user. In this instance, actions include\nenabling and disabling jobs.\n",
      "gem": "clockwork_web",
      "ghsa": "p4xx-w6fr-c4w9",
      "patched_versions": [
        "\u003e= 0.1.2"
      ],
      "title": "CSRF Vulnerability with Rails \u003c 5.2",
      "url": "https://github.com/ankane/clockwork_web/issues/4"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c0.1.2",
          "affected_versions": "All versions before 0.1.2",
          "cwe_ids": [
            "CWE-1035",
            "CWE-352",
            "CWE-937"
          ],
          "date": "2023-02-02",
          "description": "Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.",
          "fixed_versions": [
            "0.1.2"
          ],
          "identifier": "CVE-2023-25015",
          "identifiers": [
            "GHSA-p4xx-w6fr-c4w9",
            "CVE-2023-25015"
          ],
          "not_impacted": "All versions starting from 0.1.2",
          "package_slug": "gem/clockwork_web",
          "pubdate": "2023-02-02",
          "solution": "Upgrade to version 0.1.2 or above.",
          "title": "Cross-Site Request Forgery (CSRF)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2023-25015",
            "https://github.com/ankane/clockwork_web/issues/4",
            "https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857",
            "https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2",
            "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/clockwork_web/CVE-2023-25015.yml",
            "https://github.com/advisories/GHSA-p4xx-w6fr-c4w9"
          ],
          "uuid": "fa2f5f3c-7911-4b67-847a-2e48834c70ab"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:clockwork_web_project:clockwork_web:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "0.1.2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "5.2.0",
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2023-25015"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-352"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857"
            },
            {
              "name": "https://github.com/ankane/clockwork_web/issues/4",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Third Party Advisory"
              ],
              "url": "https://github.com/ankane/clockwork_web/issues/4"
            },
            {
              "name": "https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-02-09T18:48Z",
      "publishedDate": "2023-02-02T04:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-P4XX-W6FR-C4W9

CVE-2023-25015 (GCVE-0-2023-25015)

GSD-2023-25015

Tags

Sightings

Nomenclature