« Volver al listado

CVE-2016-3098

Estado: ModificadaMedia (5.4)—

Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Thoughtbot — Administrate

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-3098",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "administrate",
          "versions": [
            {
              "status": "affected",
              "version": "0.1.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-05T16:15:09.653",
  "references": [
    {
      "url": "https://seclists.org/oss-sec/2016/q2/0",
      "tags": [
        "Mailing List",
        "Mitigation",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://seclists.org/oss-sec/2016/q2/0",
      "tags": [
        "Mailing List",
        "Mitigation",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo Cross-site request forgery (CSRF) en administrate versiones 0.1.4 y anteriores, permite a atacantes remotos secuestrar el código de autorización OAuth del usuario"
    }
  ],
  "lastModified": "2026-06-17T00:44:58.130",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:thoughtbot:administrate:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B17D8066-AB96-4929-AF04-5C6AA70C54E8",
              "versionEndExcluding": "0.1.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}