| Vulnerability Name: | CVE-2011-0449 (CCN-65327) | ||||||||
| Assigned: | 2011-02-09 | ||||||||
| Published: | 2011-02-09 | ||||||||
| Updated: | 2019-08-08 | ||||||||
| Summary: | actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P) 5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-264 | ||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||
| References: | Source: MITRE Type: CNA CVE-2011-0449 Source: MLIST Type: UNKNOWN [rubyonrails-security] 20110209 Filter Problems on Case-Insensitive Filesystems Source: FEDORA Type: UNKNOWN FEDORA-2011-4358 Source: CCN Type: Ruby on Rails Web Site Ruby on Rails Source: CCN Type: SA43278 Ruby on Rails Filter Bypass and SQL Injection Vulnerabilities Source: SECUNIA Type: Vendor Advisory 43278 Source: SECTRACK Type: UNKNOWN 1025061 Source: CONFIRM Type: Patch http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4 Source: CCN Type: OSVDB ID: 70906 Ruby on Rails Filter Case-Insensitive Filesystem Issue Source: CCN Type: BID-46292 Ruby on Rails Security Bypass and SQL Injection Vulnerabilities Source: VUPEN Type: UNKNOWN ADV-2011-0877 Source: XF Type: UNKNOWN rubyonrails-filesystems-sec-bypass(65327) | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||