GitHub Advisoryadvisory · RubyGems

GHSA-rvpq-5xqx-pfpp Ruby on Rails vulnerable to code injection

HIGH Published 2017-10-24 Modified 2025-04-03 Official page ↗
Aliases
CVE-2006-4111
Ecosystem
RubyGems
Packages
rails
Severity
High
Weaknesses
CWE-94
Reviewed
2020-06-16

Affected packages

• RubyGems rails: >= 1.1.0, < 1.1.6 → fixed in 1.1.6

Description

Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.

Related

Alias · CVE (1)

  • CVE-2006-4111 Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References