CVE-2011-0449
Published Feb 21, 2011
Last updated 5 years ago
Overview
- Description
- actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
- Source
- cve@mitre.org
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 6.4
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-264
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3BE7DFE-BA20-434B-A1DE-AD038B255C60"
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DCEE5B21-C990-4705-8239-0D7B29DAEDA1"
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65EE33B1-B079-4CDE-B9C2-F1613A4610DC"
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5CAAA20B-824F-4448-99DC-9712FE628073"
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2BEBDFB-0F30-454A-B74C-F820C9D2708B"
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1D7CD8C1-95D1-477E-AD96-6582EC33BA01"
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6F00D98-3D0F-40AF-AE4F-090B1E6B660C"
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9476CE55-69C0-45D3-B723-6F459C90BF05"
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "486F5BA6-BCF7-4691-9754-19D364B4438D"
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "112FC73B-A8BC-4EEA-9F4B-CCE685EF2838"
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E4498383-6FCA-4E17-A1FD-B0CE7EE50F85"
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D26565B1-2BA6-4A3C-9264-7FC9A1820B59"
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE"
}
],
"operator": "OR"
}
]
}
]