Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Gentoo Linux | — | Upgrade dev-ruby/rails. | Oct 30, 2017 | Oct 27, 2010 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Jan 3, 2020 | Oct 28, 2010 |
| Suse | — | Upgrade rubygem-activesupport-2_3Upgrade rubygem-activerecordUpgrade rubygem-activerecord-2_3Upgrade rubygem-actionpack-2_3-docUpgrade rubygem-rails-2_3-docUpgrade rubygem-rackUpgrade rubygem-actionpack-2_3-testsuiteUpgrade rubygem-activeresource-2_3Upgrade rubygem-actionmailer-2_3Upgrade rubygem-activeresource-2_3-docUpgrade rubygem-actionmailer-2_3-testsuiteUpgrade rubygem-activeresource-2_3-testsuiteUpgrade rubygem-actionpackUpgrade rubygem-activesupportUpgrade rubygem-actionpack-2_3Upgrade rubygem-actionmailerUpgrade rubygem-activesupport-2_3-docUpgrade rubygem-rails-2_3Upgrade rubygem-activerecord-2_3-testsuiteUpgrade rubygem-railsUpgrade rubygem-actionmailer-2_3-docUpgrade rubygem-activerecord-2_3-docUpgrade rubygem-activeresource | Dec 12, 2013 | Oct 27, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub