CVE-2023-25015

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352 CWE-652

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857Patch, Third Party Advisory
https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2Patch, Third Party Advisory
https://github.com/ankane/clockwork_web/issues/4Issue Tracking, Third Party Advisory
https://github.com/ankane/clockwork_web/commit/ec2896503ee231588547c2fad4cb93a94e78f857Patch, Third Party Advisory
https://github.com/ankane/clockwork_web/compare/v0.1.1...v0.1.2Patch, Third Party Advisory
https://github.com/ankane/clockwork_web/issues/4Issue Tracking, Third Party Advisory

Timeline

Published: Feb 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-250167.5Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.CVE-2023-250178.1RIFARTEK IOT Wall has a vulnerability of incorrect authorization. An authenticated remote attacker with general user privilege is allowed to CVE-2023-250185.4RIFARTEK IOT Wall transportation function has insufficient filtering for user input. An authenticated remote attacker with general user priv CVE-2023-250196.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premio Chaty plugin <= 3.0.9 versions CVE-2023-250206.1Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions.CVE-2023-250214.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FareHarbor FareHarbor for WordPress plugin <= 3.6.6 versions.CVE-2023-250224.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Watu Quiz plugin <= 3.3.8 versions.CVE-2023-250234.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saleswonder.Biz Webinar ignition plugin <= 2.14.2 versions.CVE-2023-250244.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Icegram Icegram Collect plugin <= 1.3.8 versions.CVE-2023-250258.8Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions.CVE-2023-250264.3Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Securit CVE-2023-250274.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Chained Quiz plugin <= 1.3.2.5 versions.