Vulnerability in Rubyonrails Rails
CVE-2015-3227
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML docu…
EPSS: 0.027 (86.1th percentile) — read the EPSS interpretation.
Affected products
- Rubyonrails Rails — versions 4.1.0, 4.1.1, 4.1.2
- Opensuse — versions 13.1, 13.2
- N/a — versions n/a
Public proof-of-concept exploits
References
- 1033755 (vdb-entry, x_refsource_SECTRACK)
- 75234 (vdb-entry, x_refsource_BID)
- [rubyonrails-security] 20150616 [CVE-2015-3227] Possible Denial of Service attack in Active Support (Vendor Advisory, mailing-list, x_refsource_MLIST)
- openSUSE-SU-2015:1279 (vendor-advisory, x_refsource_SUSE)
- DSA-3464 (vendor-advisory, x_refsource_DEBIAN)
- [oss-security] 20150616 [CVE-2015-3227] Possible Denial of Service attack in Active Support (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2015-3227?
- CVE-2015-3227 is a vulnerability in Rubyonrails Rails. Published 2015-07-26.
- Is CVE-2015-3227 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.