Rails activerecord gem has Improper Input Validation vulnerability
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2010-3933US | medium6.4 | — | ||
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inp… | ||||
02
references
External citations — patches, advisories, analysis.
- http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0WEB
- https://github.com/rails/railsPACKAGE
- https://github.com/rails/rails/commit/2d96bccb1e8b62e3e11ca0c5d38aaa8cece889aeWEB
- https://github.com/rails/rails/commit/96183e0f284bab27667e5a38fa6a1578eb029585WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2010-3933.ymlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2010-3933ADVISORY
- https://web.archive.org/web/20101129225633/http://securitytracker.com/alerts/2010/Oct/1024624.htmlWEB
- https://web.archive.org/web/20111225083933/http://secunia.com/advisories/41930WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan