CVE-2011-0449

Description

actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.

Risk Information

Base Score

8.6

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C

EPSS Score

Exploitation Probability

0.555

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2011-0446,CVE-2011-0447,CVE-2011-0449 are fixed in Ruby-actionpack 3.0.4	Windows
Vulnerabilities CVE-2011-0446,CVE-2011-0447,CVE-2011-0449 are fixed in Ruby-actionpack for Linux 3.0.4	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234