| Vulnerability Name: | CVE-2006-4112 (CCN-28364) | ||||||||
| Assigned: | 2006-08-10 | ||||||||
| Published: | 2006-08-10 | ||||||||
| Updated: | 2019-08-08 | ||||||||
| Summary: | Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or "data loss," a different vulnerability than CVE-2006-4111. This vulnerability is addressed in the following product release: Ruby on Rails, Ruby on Rails, 1.1.6 | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P) 5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-noinfo | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Thu Aug 10 2006 - 21:50:48 CDT Security Vulnerability in Ruby on Rails 1.1.x Source: MITRE Type: CNA CVE-2006-4112 Source: CCN Type: SA21424 Ruby on Rails Ruby Code Execution Vulnerability Source: SECUNIA Type: Patch, Vendor Advisory 21424 Source: SECUNIA Type: Vendor Advisory 21466 Source: SECUNIA Type: Vendor Advisory 21749 Source: CCN Type: SECTRACK ID: 1016673 Rails Input Validation Flaw in `routing.rb` Lets Remote Users Execute Local Ruby Code Source: SECTRACK Type: UNKNOWN 1016673 Source: CONFIRM Type: Patch http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure Source: CCN Type: GLSA-200608-20 Ruby on Rails: Several vulnerabilities Source: GENTOO Type: Patch, Vendor Advisory GLSA-200608-20 Source: CCN Type: US-CERT VU#699540 Ruby on Rails fails to properly verify input passed via the URL Source: CERT-VN Type: Patch, US Government Resource VU#699540 Source: SUSE Type: UNKNOWN SUSE-SR:2006:021 Source: CCN Type: OSVDB ID: 28428 Ruby on Rails File Upload Request HTTP Header Unspecified Issue Source: CCN Type: Ruby on Rails Web site Ruby on Rails Source: BUGTRAQ Type: UNKNOWN 20060811 Security Vulnerability in Ruby on Rails 1.1.x Source: BID Type: Patch 19454 Source: CCN Type: BID-19454 Ruby on Rails Routing Denial of Service Vulnerability Source: XF Type: UNKNOWN rubyonrails-url-code-execution(28364) Source: XF Type: UNKNOWN rubyonrails-url-code-execution(28364) Source: SUSE Type: SUSE-SR:2006:021 SUSE Security Summary Report | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| BACK | |||||||||