GitHub Advisoryadvisory · RubyGems

GHSA-67j6-xv27-w6ww Web Console (Ruby gem) contains whitelisted_ips bypass

MEDIUM Published 2017-10-24 Modified 2023-03-14 Official page ↗
Aliases
CVE-2015-3224
Ecosystem
RubyGems
Packages
web-console
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2020-06-16

Affected packages

• RubyGems web-console: < 2.1.3 → fixed in 2.1.3

Description

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.

Related

Alias · CVE (1)

  • CVE-2015-3224 request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References