CVE-2015-7577
rubygem-activerecord: Nested attributes rejection proc bypass in Active Record
Severity Score
5.3
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.
activerecord/lib/active_record/nested_attributes.rb en Active Record en Ruby on Rails 3.1.x y 3.2.x en versiones anteriores a 3.2.22.1, 4.0.x y 4.1.x en versiones anteriores a 4.1.14.1, 4.2.x en versiones anteriores a 4.2.5.1 y 5.x en versiones anteriores a 5.0.0.beta1.1 no implementa adecuadamente una cierta opción de destruir, lo que permite a atacantes remotos eludir restricciones destinadas al cambio mediante el aprovechamiento del uso de la funcionalidad de atributos anidados.
A flaw was found in the Active Record component's handling of nested attributes in combination with the destroy flag. An attacker could possibly use this flaw to set attributes to invalid values or clear all attributes.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2015-09-29 CVE Reserved
- 2016-02-01 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-284: Improper Access Control
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2016/01/25/10 | Mailing List |
|
| http://www.securityfocus.com/bid/81806 | Vdb Entry | |
| http://www.securitytracker.com/id/1034816 | Vdb Entry | |
| https://groups.google.com/forum/message/raw?msg=ruby-security-ann/cawsWcQ6c8g/LATIsglZEgAJ | Mailing List |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.0 Search vendor "Rubyonrails" for product "Rails" and version "4.0.0" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.0 Search vendor "Rubyonrails" for product "Rails" and version "4.0.0" | beta |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.0 Search vendor "Rubyonrails" for product "Rails" and version "4.0.0" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.0 Search vendor "Rubyonrails" for product "Rails" and version "4.0.0" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.1 Search vendor "Rubyonrails" for product "Rails" and version "4.0.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.1 Search vendor "Rubyonrails" for product "Rails" and version "4.0.1" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.1 Search vendor "Rubyonrails" for product "Rails" and version "4.0.1" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.1 Search vendor "Rubyonrails" for product "Rails" and version "4.0.1" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.1 Search vendor "Rubyonrails" for product "Rails" and version "4.0.1" | rc4 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.2 Search vendor "Rubyonrails" for product "Rails" and version "4.0.2" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.3 Search vendor "Rubyonrails" for product "Rails" and version "4.0.3" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.4 Search vendor "Rubyonrails" for product "Rails" and version "4.0.4" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.4 Search vendor "Rubyonrails" for product "Rails" and version "4.0.4" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.5 Search vendor "Rubyonrails" for product "Rails" and version "4.0.5" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.6 Search vendor "Rubyonrails" for product "Rails" and version "4.0.6" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.6 Search vendor "Rubyonrails" for product "Rails" and version "4.0.6" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.6 Search vendor "Rubyonrails" for product "Rails" and version "4.0.6" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.6 Search vendor "Rubyonrails" for product "Rails" and version "4.0.6" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.7 Search vendor "Rubyonrails" for product "Rails" and version "4.0.7" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.8 Search vendor "Rubyonrails" for product "Rails" and version "4.0.8" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.9 Search vendor "Rubyonrails" for product "Rails" and version "4.0.9" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.10 Search vendor "Rubyonrails" for product "Rails" and version "4.0.10" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.0.10 Search vendor "Rubyonrails" for product "Rails" and version "4.0.10" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.0 Search vendor "Rubyonrails" for product "Rails" and version "4.1.0" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.0 Search vendor "Rubyonrails" for product "Rails" and version "4.1.0" | beta1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.0 Search vendor "Rubyonrails" for product "Rails" and version "4.1.0" | beta2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.0 Search vendor "Rubyonrails" for product "Rails" and version "4.1.0" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.0 Search vendor "Rubyonrails" for product "Rails" and version "4.1.0" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.1 Search vendor "Rubyonrails" for product "Rails" and version "4.1.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.2 Search vendor "Rubyonrails" for product "Rails" and version "4.1.2" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.2 Search vendor "Rubyonrails" for product "Rails" and version "4.1.2" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.2 Search vendor "Rubyonrails" for product "Rails" and version "4.1.2" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.2 Search vendor "Rubyonrails" for product "Rails" and version "4.1.2" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.3 Search vendor "Rubyonrails" for product "Rails" and version "4.1.3" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.4 Search vendor "Rubyonrails" for product "Rails" and version "4.1.4" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.5 Search vendor "Rubyonrails" for product "Rails" and version "4.1.5" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.6 Search vendor "Rubyonrails" for product "Rails" and version "4.1.6" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.6 Search vendor "Rubyonrails" for product "Rails" and version "4.1.6" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.6 Search vendor "Rubyonrails" for product "Rails" and version "4.1.6" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.7 Search vendor "Rubyonrails" for product "Rails" and version "4.1.7" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.7.1 Search vendor "Rubyonrails" for product "Rails" and version "4.1.7.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.8 Search vendor "Rubyonrails" for product "Rails" and version "4.1.8" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.9 Search vendor "Rubyonrails" for product "Rails" and version "4.1.9" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.9 Search vendor "Rubyonrails" for product "Rails" and version "4.1.9" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.10 Search vendor "Rubyonrails" for product "Rails" and version "4.1.10" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.10 Search vendor "Rubyonrails" for product "Rails" and version "4.1.10" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.10 Search vendor "Rubyonrails" for product "Rails" and version "4.1.10" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.10 Search vendor "Rubyonrails" for product "Rails" and version "4.1.10" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.10 Search vendor "Rubyonrails" for product "Rails" and version "4.1.10" | rc4 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.12 Search vendor "Rubyonrails" for product "Rails" and version "4.1.12" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.12 Search vendor "Rubyonrails" for product "Rails" and version "4.1.12" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.13 Search vendor "Rubyonrails" for product "Rails" and version "4.1.13" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.13 Search vendor "Rubyonrails" for product "Rails" and version "4.1.13" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.14 Search vendor "Rubyonrails" for product "Rails" and version "4.1.14" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.14 Search vendor "Rubyonrails" for product "Rails" and version "4.1.14" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.1.14 Search vendor "Rubyonrails" for product "Rails" and version "4.1.14" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | beta1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | beta2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | beta3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | beta4 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.0 Search vendor "Rubyonrails" for product "Rails" and version "4.2.0" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.1 Search vendor "Rubyonrails" for product "Rails" and version "4.2.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.1 Search vendor "Rubyonrails" for product "Rails" and version "4.2.1" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.1 Search vendor "Rubyonrails" for product "Rails" and version "4.2.1" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.1 Search vendor "Rubyonrails" for product "Rails" and version "4.2.1" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.1 Search vendor "Rubyonrails" for product "Rails" and version "4.2.1" | rc4 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.2 Search vendor "Rubyonrails" for product "Rails" and version "4.2.2" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.3 Search vendor "Rubyonrails" for product "Rails" and version "4.2.3" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.3 Search vendor "Rubyonrails" for product "Rails" and version "4.2.3" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.4 Search vendor "Rubyonrails" for product "Rails" and version "4.2.4" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.4 Search vendor "Rubyonrails" for product "Rails" and version "4.2.4" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.5 Search vendor "Rubyonrails" for product "Rails" and version "4.2.5" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.5 Search vendor "Rubyonrails" for product "Rails" and version "4.2.5" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 4.2.5 Search vendor "Rubyonrails" for product "Rails" and version "4.2.5" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 5.0.0 Search vendor "Rubyonrails" for product "Rails" and version "5.0.0" | beta1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | <= 3.2.22 Search vendor "Rubyonrails" for product "Ruby On Rails" and version " <= 3.2.22" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.0.10 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.0.10" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.0.11 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.0.11" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.0.11.1 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.0.11.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.0.12 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.0.12" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.0.13 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.0.13" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.0.13 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.0.13" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 4.1.11 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "4.1.11" | - |
Affected
| ||||||