CVE-2011-0449
Gentoo Linux Security Advisory 201412-28
Severity Score
7.3
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x anteriores a v3.0.4, cuando un sistema de ficheros sensible a mayúsculas y minúsculas se utiliza, no se aplican adecuadamente los filtros asociados a la lista de plantillas disponibles, lo que permite a atacantes remotos evitar las restricciones de acceso previsto a través de un nombre de acción que utiliza un caso no deseado para los caracteres alfabéticos.
Multiple vulnerabilities were found in Ruby on Rails, the worst of which allowing for execution of arbitrary code. Versions less than 2.3.18 are affected.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2011-01-13 CVE Reserved
- 2011-02-21 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain | Mailing List | |
| http://securitytracker.com/id?1025061 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2011/0877 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4 | 2019-08-08 |
| URL | Date | SRC |
|---|---|---|
| http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html | 2019-08-08 | |
| http://secunia.com/advisories/43278 | 2019-08-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | beta |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | beta2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | beta3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | beta4 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | rc |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.1 Search vendor "Rubyonrails" for product "Rails" and version "3.0.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.1 Search vendor "Rubyonrails" for product "Rails" and version "3.0.1" | pre |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.2 Search vendor "Rubyonrails" for product "Rails" and version "3.0.2" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.2 Search vendor "Rubyonrails" for product "Rails" and version "3.0.2" | pre |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.3 Search vendor "Rubyonrails" for product "Rails" and version "3.0.3" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.4 Search vendor "Rubyonrails" for product "Rails" and version "3.0.4" | rc1 |
Affected
| ||||||