CVE

Id
48361  
CVE No.
CVE-2011-0449  
Status
Candidate  
Description
actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.  
Phase
Assigned (20110113)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
525185 48361 CVE-2011-0449 MLIST:[rubyonrails-security] 20110209 Filter Problems on Case-Insensitive Filesystems  View
525186 48361 CVE-2011-0449 URL:http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain  View
525187 48361 CVE-2011-0449 CONFIRM:http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4  View
525188 48361 CVE-2011-0449 FEDORA:FEDORA-2011-4358  View
525189 48361 CVE-2011-0449 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html  View
525190 48361 CVE-2011-0449 SECTRACK:1025061  View
525191 48361 CVE-2011-0449 URL:http://securitytracker.com/id?1025061  View
525192 48361 CVE-2011-0449 SECUNIA:43278  View
525193 48361 CVE-2011-0449 URL:http://secunia.com/advisories/43278  View
525194 48361 CVE-2011-0449 VUPEN:ADV-2011-0877  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
30666 JVNDB-2011-000014 SEIL シリーズにおけるバッファオーバーフローの脆弱性 SEIL シリーズには、バッファオーバーフローの脆弱性が存在します。 CVE-2011-0454 48361 8.3 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000014.html  View