Описание
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
Ссылки
- Vendor Advisory
- Patch
- Vendor Advisory
- Patch
Уязвимые конфигурации
Конфигурация 1Версия до 2.0.4 (включая)
Одно из
cpe:2.3:a:rubyonrails:rails:0.9.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.9.3:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.9.4:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.9.4.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.10.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.10.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.11.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.11.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.12.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.13.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.13.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.14.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.14.2:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.14.3:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:0.14.4:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.4:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.5:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.1.6:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.3:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.4:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.5:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.2.6:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:1.9.5:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.5:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.6:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.7:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.5:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.7.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.5:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:0.9.0:*:*:*:*:*:*:*
EPSS
Процентиль: 39%
0.00169
Низкий
5 Medium
CVSS2
Дефекты
CWE-352
Связанные уязвимости
ubuntu
около 17 лет назад
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
redhat
около 17 лет назад
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
debian
около 17 лет назад
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remo ...
EPSS
Процентиль: 39%
0.00169
Низкий
5 Medium
CVSS2
Дефекты
CWE-352