CVEvulnerability
CVE-2011-0449
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2011-02-21
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
Affected configurations
• rubyonrails rails 3.0.0
• rubyonrails rails 3.0.1
• rubyonrails rails 3.0.2
• rubyonrails rails 3.0.3
• rubyonrails rails 3.0.4
Related
Weakness · not in database (1)
References
- http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain groups.google.com
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html lists.fedoraproject.org
- http://secunia.com/advisories/43278 Vendor Advisory
- http://securitytracker.com/id?1025061 securitytracker.com
- http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4 Patch
- http://www.vupen.com/english/advisories/2011/0877 www.vupen.com
- http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain groups.google.com
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html lists.fedoraproject.org
- http://secunia.com/advisories/43278 Vendor Advisory
- http://securitytracker.com/id?1025061 securitytracker.com
- http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4 Patch
- http://www.vupen.com/english/advisories/2011/0877 www.vupen.com