WS-2017-0180 (Medium) detected in devise_invitable-1.3.4.gem

[mend-bolt-for-github]

WS-2017-0180 - Medium Severity Vulnerability

Vulnerable Library - devise_invitable-1.3.4.gem

It adds support for send invitations by email (it requires to be authenticated) and accept the invitation by setting a password.

Library home page: https://rubygems.org/gems/devise_invitable-1.3.4.gem

Path to dependency file: /example-rubygems-travis/Gemfile.lock

Path to vulnerable library: /gems/2.3.0/cache/devise_invitable-1.3.4.gem

Dependency Hierarchy:

• ❌ devise_invitable-1.3.4.gem (Vulnerable Library)

Found in HEAD commit: a4378db10e5839219d3a7b5cb4cb4bc333c6e756

Vulnerability Details

Affected versions of the package are vulnerable to Cross-Site Request Forgery (CSRF) attacks.

Publish Date: 2017-03-28

URL: WS-2017-0180

CVSS 2 Score Details (5.6)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: scambra/devise_invitable@d1bb19e

Release Date: 2014-04-14

Fix Resolution: Replace or update the following file: invitations_controller.rb

---

Step up your Open Source Security Game with WhiteSource here