CVE-2010-3933 Rails activerecord gem has Improper Input Validation vulnerability
MediumCVSS 6.4
EPSS 2.2%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems activerecord(RubyGems) | >= 2.3.9, < 2.3.10 | 2.3.10 |
| rubygems activerecord(RubyGems) | >= 3.0.0, < 3.0.1 | 3.0.1 |
| rubygems activerecord(RubyGems) | = 2.3.9 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.0 | No fix listed |
| rubyonrails rails | = 2.3.9 | No fix listed |
| rubyonrails rails | = 3.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- weblog.rubyonrails.org vendor-advisory
- github.com exploit
- web.archive.org
- github.com patch
- github.com patch
- web.archive.org
- web.archive.org
- github.com
- github.com product
- 41930 third-party-advisory vendor-advisory
- 1024624 vdb-entry
- ADV-2010-2719 vdb-entry vendor-advisory
- Debian Security Tracker CVE-2010-3933 vendor-advisory