PRIOn knowledge basePRION:CVE-2011-0447Cross site request forgery (csrf)
6.8 Medium
AI Score
Confidence
Low
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.004 Low
EPSS
Percentile
72.5%
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage βcombinations of browser plugins and HTTP redirects,β a related issue to CVE-2011-0696.
References
secunia.com/advisories/43274
secunia.com/advisories/43666
weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
www.debian.org/security/2011/dsa-2247
www.securityfocus.com/bid/46291
www.securitytracker.com/id?1025060
www.vupen.com/english/advisories/2011/0587
www.vupen.com/english/advisories/2011/0877
groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain
lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
Related
6.8 Medium
AI Score
Confidence
Low
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.004 Low
EPSS
Percentile
72.5%