CVE-2011-0449 | BDVDB-2026-45204 Detail
Description#
actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://securitytracker.com/id?1025061
- http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain
- http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
- http://secunia.com/advisories/43278
- http://www.vupen.com/english/advisories/2011/0877
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.