CVE-2011-2929 actionpack Improper Input Validation vulnerability
MediumCVSS 5.0
EPSS 1.8%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems actionpack(RubyGems) | >= 3.0.0, < 3.0.10 | 3.0.10 |
| rubygems actionpack(RubyGems) | = 3.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.10.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.4.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.5.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.6.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.6.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.7 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.7.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.7.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.8 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.8.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.8.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.8.rc4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9.rc4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9.rc5 | No fix listed |
Show 41 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubyonrails rails | = 3.0.0 | No fix listed |
| rubyonrails rails | = 3.0.0-beta | No fix listed |
| rubyonrails rails | = 3.0.0-beta2 | No fix listed |
| rubyonrails rails | = 3.0.0-beta3 | No fix listed |
| rubyonrails rails | = 3.0.0-beta4 | No fix listed |
| rubyonrails rails | = 3.0.0-rc | No fix listed |
| rubyonrails rails | = 3.0.0-rc2 | No fix listed |
| rubyonrails rails | = 3.0.1 | No fix listed |
| rubyonrails rails | = 3.0.1-pre | No fix listed |
| rubyonrails rails | = 3.0.2 | No fix listed |
| rubyonrails rails | = 3.0.2-pre | No fix listed |
| rubyonrails rails | = 3.0.3 | No fix listed |
| rubyonrails rails | = 3.0.4-rc1 | No fix listed |
| rubyonrails rails | = 3.0.5 | No fix listed |
| rubyonrails rails | = 3.0.5-rc1 | No fix listed |
| rubyonrails rails | = 3.0.6 | No fix listed |
| rubyonrails rails | = 3.0.6-rc1 | No fix listed |
| rubyonrails rails | = 3.0.6-rc2 | No fix listed |
| rubyonrails rails | = 3.0.7 | No fix listed |
| rubyonrails rails | = 3.0.7-rc1 | No fix listed |
| rubyonrails rails | = 3.0.7-rc2 | No fix listed |
| rubyonrails rails | = 3.0.8 | No fix listed |
| rubyonrails rails | = 3.0.8-rc1 | No fix listed |
| rubyonrails rails | = 3.0.8-rc2 | No fix listed |
| rubyonrails rails | = 3.0.8-rc3 | No fix listed |
| rubyonrails rails | = 3.0.8-rc4 | No fix listed |
| rubyonrails rails | = 3.0.9 | No fix listed |
| rubyonrails rails | = 3.0.9-rc1 | No fix listed |
| rubyonrails rails | = 3.0.9-rc2 | No fix listed |
| rubyonrails rails | = 3.0.9-rc3 | No fix listed |
| rubyonrails rails | = 3.0.9-rc4 | No fix listed |
| rubyonrails rails | = 3.0.9-rc5 | No fix listed |
| rubyonrails rails | = 3.0.10-rc1 | No fix listed |
| rubyonrails rails | = 3.1.0 | No fix listed |
| rubyonrails rails | = 3.1.0-beta1 | No fix listed |
| rubyonrails rails | = 3.1.0-rc1 | No fix listed |
| rubyonrails rails | = 3.1.0-rc2 | No fix listed |
| rubyonrails rails | = 3.1.0-rc3 | No fix listed |
| rubyonrails rails | = 3.1.0-rc4 | No fix listed |
| rubyonrails rails | = 3.1.0-rc5 | No fix listed |
| rubyonrails ruby on rails | = 3.0.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugzilla.redhat.com patch
- [rubyonrails-security] 20110816 Filter Skipping Vulnerability in Ruby on Rails 3.0 mailing-list patch
- FEDORA-2011-11572 vendor-advisory
- FEDORA-2011-11386 vendor-advisory
- weblog.rubyonrails.org patch
- [oss-security] 20110817 CVE request: ruby on rails flaws (4) mailing-list patch
- [oss-security] 20110819 Re: CVE request: ruby on rails flaws (4) mailing-list patch
- [oss-security] 20110820 Re: CVE request: ruby on rails flaws (4) mailing-list patch
- [oss-security] 20110822 Re: CVE request: ruby on rails flaws (4) mailing-list patch
- [oss-security] 20110822 Re: CVE request: ruby on rails flaws (4) mailing-list
- [oss-security] 20110822 Re: CVE request: ruby on rails flaws (4) mailing-list patch
- github.com exploit
- rubyonrails.org
- github.com
- github.com product
- Debian Security Tracker CVE-2011-2929 vendor-advisory