CVE-2010-3933

Опубликовано: 28 окт. 2010

Источник: nvd

CVSS2: 6.4

EPSS Низкий

Описание

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.

Ссылки

http://secunia.com/advisories/41930
Vendor Advisory
http://securitytracker.com/id?1024624
http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0
Vendor Advisory
http://www.vupen.com/english/advisories/2010/2719
Vendor Advisory
http://secunia.com/advisories/41930
Vendor Advisory
http://securitytracker.com/id?1024624
http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0
Vendor Advisory
http://www.vupen.com/english/advisories/2010/2719
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00712

Низкий

6.4 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2010-3933

ubuntu

больше 15 лет назад

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.

CVE-2010-3933

debian

больше 15 лет назад

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attribut ...

GHSA-gjxw-5w2q-7grf

github

больше 8 лет назад

Rails activerecord gem has Improper Input Validation vulnerability

EPSS

Процентиль: 72%

0.00712

Низкий

6.4 Medium

CVSS2

Дефекты

CWE-20