CVEvulnerability
CVE-2010-3933
6.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-10-28
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-20
Description
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
Affected configurations
• rubyonrails rails 2.3.9
• rubyonrails rails 3.0.0
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://secunia.com/advisories/41930 Vendor Advisory
- http://securitytracker.com/id?1024624 securitytracker.com
- http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0 Vendor Advisory
- http://www.vupen.com/english/advisories/2010/2719 Vendor Advisory
- http://secunia.com/advisories/41930 Vendor Advisory
- http://securitytracker.com/id?1024624 securitytracker.com
- http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0 Vendor Advisory
- http://www.vupen.com/english/advisories/2010/2719 Vendor Advisory