CSRF Vulnerability #4
Description
Clockwork Web is vulnerable to cross-site request forgery (CSRF) with Rails < 5.2. This vulnerability has been assigned the CVE identifier CVE-2023-25015.
Versions Affected: 0.1.1 and below
Fixed Versions: 0.1.2
Impact
Clockwork Web is vulnerable to cross-site request forgery (CSRF) with Rails < 5.2.
A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs.
All users running an affected release on Rails < 5.2 should upgrade immediately.