CVE-2010-3933

Опубликовано: 28 окт. 2010

Источник: nvd

CVSS2: 6.4

EPSS Низкий

Описание

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.

Ссылки

http://secunia.com/advisories/41930
Vendor Advisory
http://securitytracker.com/id?1024624
http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0
Vendor Advisory
http://www.vupen.com/english/advisories/2010/2719
Vendor Advisory
http://secunia.com/advisories/41930
Vendor Advisory
http://securitytracker.com/id?1024624
http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0
Vendor Advisory
http://www.vupen.com/english/advisories/2010/2719
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 81%

0.0225

Низкий

6.4 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2010-3933

ubuntu

почти 16 лет назад

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.

CVE-2010-3933

debian

почти 16 лет назад

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attribut ...

GHSA-gjxw-5w2q-7grf

github

почти 9 лет назад

Rails activerecord gem has Improper Input Validation vulnerability

EPSS

Процентиль: 81%

0.0225

Низкий

6.4 Medium

CVSS2

Дефекты

CWE-20