CVE-2011-3624

🗓️ 26 Nov 2019 02:50:40Reported by redhatType

Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header. NV

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2011-3624	26 Nov 201908:57	–	circl
Cvelist	CVE-2011-3624	26 Nov 201902:50	–	cvelist
EUVD	EUVD-2011-3583	7 Oct 202500:30	–	euvd
NVD	CVE-2011-3624	26 Nov 201903:15	–	nvd
Prion	Design/Logic Flaw	26 Nov 201903:15	–	prion
Snyk	Arbitrary Code Injection	26 Nov 201903:15	–	snyk
UbuntuCve	CVE-2011-3624	26 Nov 201903:15	–	ubuntucve
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2011-3624	3 Mar 202500:00	–	nessus

NVD

Vulners

Node

ruby-lang rubyMatch1.8.7

ruby-lang rubyMatch1.9.2

[
  {
    "product": "Ruby",
    "vendor": "Ruby",
    "versions": [
      {
        "status": "affected",
        "version": "1.9.2"
      },
      {
        "status": "affected",
        "version": "1.8.7 and earlier"
      }
    ]
  }
]

Source	Link
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
redmine	www.redmine.ruby-lang.org/issues/5418
security-tracker	www.security-tracker.debian.org/tracker/CVE-2011-3624
access	www.access.redhat.com/security/cve/cve-2011-3624

21 Nov 2024 01:30Current

5.3Medium risk

Vulners AI Score5.3

CVSS 25

CVSS 3.15.3

EPSS0.00926

CWE-74