Lucene search

K
nvd[email protected]NVD:CVE-2011-0449
HistoryFeb 21, 2011 - 6:00 p.m.

CVE-2011-0449

2011-02-2118:00:01
CWE-264
web.nvd.nist.gov
1

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

6.5

Confidence

Low

EPSS

0.011

Percentile

84.8%

actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.

Affected configurations

NVD
Node
rubyonrailsrailsMatch3.0.0
OR
rubyonrailsrailsMatch3.0.0beta
OR
rubyonrailsrailsMatch3.0.0beta2
OR
rubyonrailsrailsMatch3.0.0beta3
OR
rubyonrailsrailsMatch3.0.0beta4
OR
rubyonrailsrailsMatch3.0.0rc
OR
rubyonrailsrailsMatch3.0.0rc2
OR
rubyonrailsrailsMatch3.0.1
OR
rubyonrailsrailsMatch3.0.1pre
OR
rubyonrailsrailsMatch3.0.2
OR
rubyonrailsrailsMatch3.0.2pre
OR
rubyonrailsrailsMatch3.0.3
OR
rubyonrailsrailsMatch3.0.4rc1

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

6.5

Confidence

Low

EPSS

0.011

Percentile

84.8%