Описание
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
Ссылки
- Vendor Advisory
- Patch
- Vendor Advisory
- Patch
Уязвимые конфигурации
Конфигурация 1Версия до 2.0.4 (включая)
Одно из
cpe:2.3:a:rubyonrails:rails:0.9.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.9.3:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.9.4:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.9.4.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.10.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.10.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.11.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.11.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.12.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.13.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.13.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.14.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.14.2:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.14.3:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.14.4:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.4:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.5:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.6:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.5:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.6:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.9.5:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.5:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.6:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.7:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.5:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.7.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.5:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.9.0:*:*:*:*:*:*:*
EPSS
Процентиль: 72%
0.01533
Низкий
5 Medium
CVSS2
Дефекты
CWE-352
Связанные уязвимости
ubuntu
больше 17 лет назад
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
redhat
почти 18 лет назад
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
debian
больше 17 лет назад
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remo ...
EPSS
Процентиль: 72%
0.01533
Низкий
5 Medium
CVSS2
Дефекты
CWE-352