GitHub Advisoryadvisory · RubyGems

GHSA-jmgf-p46x-982h rails is vulnerable to CRLF injection

MEDIUM Published 2017-10-24 Modified 2025-04-09 Official page ↗
Aliases
CVE-2008-5189
Ecosystem
RubyGems
Packages
rails
Severity
Moderate
Weaknesses
CWE-352
Reviewed
2020-06-16

Affected packages

• RubyGems rails: < 2.0.5 → fixed in 2.0.5

Description

CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.

Related

Alias · CVE (1)

  • CVE-2008-5189 CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References