CVE-2019-16676

Опубликовано: 30 сент. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.

Ссылки

http://blog.plataformatec.com.br/2019/09/incorrect-access-control-in-simple-form-cve-2019-16676/
Exploit
Vendor Advisory
https://github.com/plataformatec/simple_form/commits/master
Patch
Third Party Advisory
https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx
Third Party Advisory
http://blog.plataformatec.com.br/2019/09/incorrect-access-control-in-simple-form-cve-2019-16676/
Exploit
Vendor Advisory
https://github.com/plataformatec/simple_form/commits/master
Patch
Third Party Advisory
https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:plataformatec:simple_form:*:*:*:*:*:*:*:*

Версия до 5.0 (исключая)

EPSS

Процентиль: 74%

0.0083

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2019-16676

CVSS3: 9.8

ubuntu

больше 6 лет назад

Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.

CVE-2019-16676

CVSS3: 9.8

debian

больше 6 лет назад

Plataformatec Simple Form has Incorrect Access Control in file_method? ...

GHSA-r74q-gxcg-73hx

CVSS3: 9.8

github

больше 6 лет назад

Improper Input Validation in simple_form

EPSS

Процентиль: 74%

0.0083

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-20