onyx --cves cve-2016-2098
CVE-2016-2098
- score
- <0.1
- cvss
- 7.3
- epss
- 81.4%
- published
- 2016-04-07
- kev added
- —
- first seen
Ruby on Rails Action Pack before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 contain a remote code execution caused by unrestricted use of the render method, letting attackers execute arbitrary Ruby code remotely, exploit requires sending crafted requests.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC https://www.exploit-db.com/exploits/40086/
Exploit availability
Weaknesses
References 12
- http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
- http://www.securitytracker.com/id/1035122
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
- http://www.debian.org/security/2016/dsa-3509
- http://www.securityfocus.com/bid/83725
- https://www.exploit-db.com/exploits/40086/