GoogleOSV:GHSA-543V-GJ2C-R3CHactivemodel contains Improper Input Validation
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.004 Low
EPSS
Percentile
74.0%
Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.
References
lists.fedoraproject.org/pipermail/package-announce/2016-February/178041.html
lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html
lists.fedoraproject.org/pipermail/package-announce/2016-February/178047.html
lists.fedoraproject.org/pipermail/package-announce/2016-February/178065.html
lists.fedoraproject.org/pipermail/package-announce/2016-February/178066.html
lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
rhn.redhat.com/errata/RHSA-2016-0296.html
www.debian.org/security/2016/dsa-3464
www.openwall.com/lists/oss-security/2016/01/25/14
github.com/rails/rails
github.com/rubysec/ruby-advisory-db/blob/master/gems/activemodel/CVE-2016-0753.yml
groups.google.com/forum/#!topic/rubyonrails-security/6jQVC1geukQ
nvd.nist.gov/vuln/detail/CVE-2016-0753
web.archive.org/web/20160405205300/www.securitytracker.com/id/1034816
web.archive.org/web/20200228000230/www.securityfocus.com/bid/82247
web.archive.org/web/20210613054843/https://groups.google.com/forum/message/raw?msg=ruby-security-ann/6jQVC1geukQ/3Iy0GU1ZEgAJ
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.004 Low
EPSS
Percentile
74.0%