onyx --cves cve-2011-2929
CVE-2011-2929
- score
- <0.1
- cvss
- 5.0
- epss
- 1.8%
- published
- 2011-08-29
- kev added
- —
- first seen
Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 contain a template rendering bypass caused by improper handling of glob characters in template resolver, letting remote attackers render arbitrary views via crafted URLs, exploit requires sending malicious URL.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 12
- http://groups.google.com/group/rubyonrails-security/msg/cbbbba6e4f7eaf61?dmode=source&output=gplain
- http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
- http://www.openwall.com/lists/oss-security/2011/08/19/11
- http://www.openwall.com/lists/oss-security/2011/08/22/13
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
- http://www.openwall.com/lists/oss-security/2011/08/22/14
- http://www.openwall.com/lists/oss-security/2011/08/17/1
- http://www.openwall.com/lists/oss-security/2011/08/20/1
- http://www.openwall.com/lists/oss-security/2011/08/22/5
- https://bugzilla.redhat.com/show_bug.cgi?id=731432
- https://github.com/rails/rails/commit/5f94b93279f6d0682fafb237c301302c107a9552