Improper input validation in Rubyonrails Rails
CVE-2010-3933
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.022 (81.1th percentile) — read the EPSS interpretation.
Affected products
- Rubyonrails Rails — versions 3.0.0, 2.3.9
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)