actionpack allows remote code execution via application's unrestricted use of render method
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2016-2098US | high7.3 | Exploit | ||
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's un… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.htmlWEB
- http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-releasedWEB
- http://www.debian.org/security/2016/dsa-3509WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan