GitHub Advisoryadvisory · RubyGems
GHSA-gjxw-5w2q-7grf Rails activerecord gem has Improper Input Validation vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2010-3933
- Ecosystem
- RubyGems
- Packages
- activerecord
- Severity
- Moderate
- Weaknesses
- CWE-20
- Reviewed
- 2020-06-16
Affected packages
• RubyGems activerecord: >= 2.3.9, < 2.3.10 → fixed in 2.3.10
• RubyGems activerecord: >= 3.0.0, < 3.0.1 → fixed in 3.0.1
Description
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
Related
Alias · CVE (1)
- CVE-2010-3933 Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2010-3933 advisory
- https://github.com/rails/rails/commit/2d96bccb1e8b62e3e11ca0c5d38aaa8cece889ae web
- https://github.com/rails/rails/commit/96183e0f284bab27667e5a38fa6a1578eb029585 web
- https://github.com/rails/rails package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2010-3933.yml web
- https://web.archive.org/web/20101129225633/http://securitytracker.com/alerts/2010/Oct/1024624.html web
- https://web.archive.org/web/20111225083933/http://secunia.com/advisories/41930 web
- https://web.archive.org/web/20201208053819/http://securitytracker.com/id?1024624 web
- http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0 web