CVE-2011-0449

Опубликовано: 21 фев. 2011

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*

cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*

EPSS

Процентиль: 68%

0.00555

Низкий

7.5 High

CVSS2

Дефекты

CWE-264

Связанные уязвимости

CVE-2011-0449

ubuntu

почти 15 лет назад

CVE-2011-0449

debian

почти 15 лет назад

actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x ...

GHSA-4ww3-3rxj-8v6q

github

около 8 лет назад

actionpack allows remote attackers to bypass intended access restrictions

EPSS

Процентиль: 68%

0.00555

Низкий

7.5 High

CVSS2

Дефекты

CWE-264