Описание
The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 2.3.14.1 |
| hardy | ignored | end of life |
| lucid | not-affected | 2.2.3-2 |
| maverick | not-affected | 2.3.5-1.1 |
| natty | not-affected | 2.3.5-1.2ubuntu1 |
| upstream | needs-triage |
Показывать по
EPSS
4.3 Medium
CVSS2
Связанные уязвимости
The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip ...
EPSS
4.3 Medium
CVSS2