GitHub Advisoryadvisory · RubyGems

GHSA-78rc-8c29-p45g actionpack allows remote code execution via application's unrestricted use of render method

HIGH Published 2017-10-24 Modified 2023-07-03 Official page ↗
Aliases
CVE-2016-2098
Ecosystem
RubyGems
Packages
actionpack
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• RubyGems actionpack: >= 3.0.0, < 3.2.22.2 → fixed in 3.2.22.2 • RubyGems actionpack: >= 4.0.0, < 4.1.14.2 → fixed in 4.1.14.2 • RubyGems actionpack: >= 4.2.0, < 4.2.5.2 → fixed in 4.2.5.2

Description

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Related

Alias · CVE (1)

  • CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References