Lucene search
RubySecRUBY:ACTIONPACK-2011-0447HistoryOct 23, 2017 - 9:00 p.m.
CSRF Protection Bypass in Ruby on Rails
2017-10-2321:00:00
RubySec
rubysec.com
8
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and
3.x before 3.0.4, does not properly validate HTTP requests that
contain an X-Requested-With header, which makes it easier for
remote attackers to conduct cross-site request forgery (CSRF)
attacks via forged (1) AJAX or (2) API requests that leverage
“combinations of browser plugins and HTTP redirects,”
a related issue to CVE-2011-0696.
| CPE | Name | Operator | Version |
|---|---|---|---|
| actionpack | lt | 2.1.0 | |
| actionpack | le | 2.3.10 | |
| actionpack | ge | 2.4.0 | |
| actionpack | lt | 3.0.4 |
Related
fedora
fedora
[SECURITY] Fedora 14 Update: Django-1.2.5-1.fc14
2011-02-19 01:27:31
[SECURITY] Fedora 13 Update: Django-1.2.5-1.fc13
2011-02-19 01:27:19
openvas
openvas
Debian Security Advisory DSA 2163-1 (python-django)
2011-03-07 00:00:00
Fedora Update for audacious-plugins FEDORA-2011-12350
2011-09-12 00:00:00
Fedora Update for audacious-plugins FEDORA-2011-12350
2011-09-12 00:00:00
osv
osv
Moderate severity vulnerability that affects django
2018-07-23 19:51:10
actionpack Cross-Site Request Forgery vulnerability
2017-10-24 18:33:38
python-django - multiple
2011-02-14 00:00:00
gitlab
gitlab
Cross-Site Request Forgery (CSRF)
2017-10-24 00:00:00
Cross-Site Request Forgery
2018-07-23 00:00:00
github
github
actionpack Cross-Site Request Forgery vulnerability
2017-10-24 18:33:38
Moderate severity vulnerability that affects django
2018-07-23 19:51:10
nessus
nessus
Debian DSA-2163-1 : python-django - multiple vulnerabilities
2011-02-15 00:00:00
Ubuntu 9.10 / 10.04 LTS / 10.10 : python-django vulnerabilities (USN-1066-1)
2011-02-18 00:00:00
Fedora 14 : Django-1.2.5-1.fc14 (2011-1235)
2011-02-20 00:00:00
debiancve
debiancve
CVE-2011-0696
2011-02-14 21:00:00
CVE-2011-0447
2011-02-14 21:00:00
prion
prion
Cross site request forgery (csrf)
2011-02-14 21:00:00
Cross site request forgery (csrf)
2011-02-14 21:00:00
securityvulns
securityvulns
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
2011-02-15 00:00:00
[SECURITY] [DSA 2163-1] python-django security update
2011-02-15 00:00:00
debian
debian
[SECURITY] [DSA 2163-1] python-django security update
2011-02-14 18:31:55
[SECURITY] [DSA 2163-2] dajaxice regression fix
2011-03-01 20:17:00
cve
cve
CVE-2011-0696
2011-02-14 21:00:00
CVE-2011-0447
2011-02-14 21:00:00
ubuntu
ubuntu
Django vulnerabilities
2011-02-17 00:00:00
ubuntucve
ubuntucve
CVE-2011-0447
2011-02-14 00:00:00
CVE-2011-0696
2011-02-14 00:00:00
Related for RUBY:ACTIONPACK-2011-0447