CVE-2008-7248 Improper Input Validation in actionpack
MediumCVSS 6.8
EPSS 8.1%
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems actionpack(RubyGems) | >= 2.1.0, < 2.1.3 | 2.1.3 |
| rubygems actionpack(RubyGems) | >= 2.2.0, < 2.2.2 | 2.2.2 |
| rubygems actionpack(RubyGems) | = 2.1.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.1.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.1.2 | No fix listed |
| rubyonrails rails | = 2.1.0 | No fix listed |
| rubyonrails rails | = 2.1.1 | No fix listed |
| rubyonrails rails | = 2.1.2 | No fix listed |
| rubyonrails rails | = 2.2.0 | No fix listed |
| rubyonrails rails | = 2.2.1 | No fix listed |
| debian/rails(Debian:12) | < 2.2.3-1 | 2.2.3-1 |
| debian/rails(Debian:13) | < 2.2.3-1 | 2.2.3-1 |
| debian/rails(Debian:14) | < 2.2.3-1 | 2.2.3-1 |
References
- Debian Security Tracker CVE-2008-7248 vendor-advisory
- bugs.debian.org issue-tracking
- nvd.nist.gov third-party-advisory vendor-advisory
- access.redhat.com
- bugzilla.redhat.com
- groups.google.com
- lists.opensuse.org
- pseudo-flaw.net
- weblog.rubyonrails.org
- www.openwall.com
- www.openwall.com
- www.rorsecurity.info
- github.com exploit
- groups.google.com
- SUSE-SR:2010:006 vendor-advisory
- pseudo-flaw.net
- weblog.rubyonrails.org
- [oss-security] 20091128 CVE request: Ruby on Rails: CSRF circumvention (from 2008) mailing-list
- [oss-security] 20091202 Re: CVE request: Ruby on Rails: CSRF circumvention (from 2008) mailing-list
- github.com patch
- web.archive.org
- github.com
- github.com product
- 36600 third-party-advisory vendor-advisory
- 38915 third-party-advisory
- www.rorsecurity.info exploit
- ADV-2009-2544 vdb-entry vendor-advisory