CVE-2013-4593

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

RubyGem omniauth-facebook has an access token security vulnerability

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
omniauth-facebook	omniauth-facebook	<= 1.5.0

References

http://www.openwall.com/lists/oss-security/2013/11/18/6Mailing List, Patch, Third Party Advisory
https://access.redhat.com/security/cve/cve-2013-4593Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/89040Third Party Advisory, VDB Entry
https://security-tracker.debian.org/tracker/CVE-2013-4593Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/11/18/6Mailing List, Patch, Third Party Advisory
https://access.redhat.com/security/cve/cve-2013-4593Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/89040Third Party Advisory, VDB Entry
https://security-tracker.debian.org/tracker/CVE-2013-4593Third Party Advisory

Timeline

Published: Dec 11, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-45944.3The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous CVE-2013-45954.3The Secure Pages module 6.x-2.x before 6.x-2.0 for Drupal does not properly match URLs, which causes HTTP to be used instead of HTTPS and ma CVE-2013-45965.8The Node Access Keys module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote attackers to bypass a CVE-2013-45974.0The Revisioning module 7.x-1.x before 7.x-1.6 for Drupal does not properly check node access permissions for content marked unpublished by t CVE-2013-45985.0The Groups, Communities and Co (GCC) module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permission, which allows remote attack CVE-2013-45994.3The Misery module 6.x-2.x before 6.x-2.5 and 7.x-2.x before 7.x-2.2 for Drupal, when the "delay misery" configuration is set to a high value CVE-2013-46004.3Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or CVE-2013-46025.5A Denial of Service (infinite loop) vulnerability exists in Avira AntiVir Engine before 8.2.12.58 via an unspecified function in the PDF Sca CVE-2013-46046.5Fortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities, which allows remote authenticated users to CVE-2013-46084.3Cross-site scripting (XSS) vulnerability in REDCap before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via vectors i CVE-2013-46096.5REDCap before 5.0.4 and 5.1.x before 5.1.3 does not reject certain undocumented syntax within branching logic and calculations, which allows CVE-2013-461010.0Unspecified vulnerability in the Data Search utility in data-entry forms in REDCap before 5.0.3 and 5.1.x before 5.1.2 has unknown impact an