GitHub Advisoryadvisory · RubyGems

GHSA-3vfw-7rcp-3xgm actionpack Improper Input Validation vulnerability

MEDIUM Published 2017-10-24 Modified 2023-05-12 Official page ↗
Aliases
CVE-2011-3187
Ecosystem
RubyGems
Packages
actionpack
Severity
Moderate
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• RubyGems actionpack: >= 2.3.0, < 2.3.13 → fixed in 2.3.13

Description

The `to_s` method in `actionpack/lib/action_dispatch/middleware/remote_ip.rb` in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

Related

Alias · CVE (1)

  • CVE-2011-3187 The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References