CVE

Id
48359  
CVE No.
CVE-2011-0447  
Status
Candidate  
Description
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.  
Phase
Assigned (20110113)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
525153 48359 CVE-2011-0447 MLIST:[rubyonrails-security] 20110209 CSRF Protection Bypass in Ruby on Rails  View
525154 48359 CVE-2011-0447 URL:http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain  View
525155 48359 CVE-2011-0447 CONFIRM:http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails  View
525156 48359 CVE-2011-0447 DEBIAN:DSA-2247  View
525157 48359 CVE-2011-0447 URL:http://www.debian.org/security/2011/dsa-2247  View
525158 48359 CVE-2011-0447 FEDORA:FEDORA-2011-2133  View
525159 48359 CVE-2011-0447 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html  View
525160 48359 CVE-2011-0447 FEDORA:FEDORA-2011-2138  View
525161 48359 CVE-2011-0447 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html  View
525162 48359 CVE-2011-0447 FEDORA:FEDORA-2011-4358  View
525163 48359 CVE-2011-0447 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html  View
525164 48359 CVE-2011-0447 BID:46291  View
525165 48359 CVE-2011-0447 URL:http://www.securityfocus.com/bid/46291  View
525166 48359 CVE-2011-0447 SECTRACK:1025060  View
525167 48359 CVE-2011-0447 URL:http://www.securitytracker.com/id?1025060  View
525168 48359 CVE-2011-0447 SECUNIA:43274  View
525169 48359 CVE-2011-0447 URL:http://secunia.com/advisories/43274  View
525170 48359 CVE-2011-0447 SECUNIA:43666  View
525171 48359 CVE-2011-0447 URL:http://secunia.com/advisories/43666  View
525172 48359 CVE-2011-0447 VUPEN:ADV-2011-0587  View
525173 48359 CVE-2011-0447 URL:http://www.vupen.com/english/advisories/2011/0587  View
525174 48359 CVE-2011-0447 VUPEN:ADV-2011-0877  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
30664 JVNDB-2011-000012 Lunascape における実行ファイル読み込みに関する脆弱性 Lunascape には、実行ファイル読み込みに関する脆弱性が存在します。 CVE-2011-0452 48359 5.1 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000012.html  View