GHSA-gjxw-5w2q-7grf

Source

https://github.com/advisories/GHSA-gjxw-5w2q-7grf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-gjxw-5w2q-7grf/GHSA-gjxw-5w2q-7grf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gjxw-5w2q-7grf

Aliases

CVE-2010-3933

Published

2017-10-24T18:33:38Z

Modified

2024-12-07T05:40:02Z

Summary

Rails activerecord gem has Improper Input Validation vulnerability

Details

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.

Database specific

{
    "cwe_ids":  [
        "CWE-20"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T21:37:34Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

RubyGems / activerecord

Package

Name: activerecord
Purl: pkg:gem/activerecord

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.3.9

Fixed

2.3.10

Affected versions

2.*

2.3.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-gjxw-5w2q-7grf/GHSA-gjxw-5w2q-7grf.json"