Ubuntu.comUB:CVE-2011-2929CVE-2011-2929
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.008 Low
EPSS
Percentile
80.9%
The template selection functionality in
actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x
before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob
characters, which allows remote attackers to render arbitrary views via a
crafted URL, related to a “filter skipping vulnerability.”
Notes
| Author | Note |
|---|---|
| mdeslaur | only affects 3.x |
References
groups.google.com/group/rubyonrails-security/browse_thread/thread/3420ac71aed312d6
www.openwall.com/lists/oss-security/2011/08/19/11
bugzilla.redhat.com/show_bug.cgi?id=731432
launchpad.net/bugs/cve/CVE-2011-2929
nvd.nist.gov/vuln/detail/CVE-2011-2929
security-tracker.debian.org/tracker/CVE-2011-2929
www.cve.org/CVERecord?id=CVE-2011-2929
Related
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.008 Low
EPSS
Percentile
80.9%