NVD

Id
28105  
Name
CVE-2015-7577  
Description
activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-02-15  
Modified Date
2016-12-05  
Seq
2015-7577  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
147752 28105 CVE-2015-7577 FEDORA-2016-73fe05d878  View
147753 28105 CVE-2015-7577 FEDORA-2016-cc465a34df  View
147754 28105 CVE-2015-7577 SUSE-SU-2016:1146  View
147755 28105 CVE-2015-7577 openSUSE-SU-2016:0363  View
147756 28105 CVE-2015-7577 openSUSE-SU-2016:0372  View
147757 28105 CVE-2015-7577 RHSA-2016:0296  View
147758 28105 CVE-2015-7577 DSA-3464  View
147759 28105 CVE-2015-7577 [oss-security] 20160125 [CVE-2015-7577] Nested attributes rejection proc bypass in Active Record.  View
147760 28105 CVE-2015-7577 81806  View
147761 28105 CVE-2015-7577 [ruby-security-ann] 20160125 [CVE-2015-7577] Nested attributes rejection proc bypass in Active Record.  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
11667 JVNDB-2015-006987 Ruby on Rails の Active Record の activerecord/lib/active_record/nested_attributes.rb における変更制限を回避される脆弱性 Ruby on Rails の Active Record の activerecord/lib/active_record/nested_attributes.rb は、特定の destroy オプションを適切に実装していないため、変更制限を回避される脆弱性が存在します。 CVE-2015-7577 84802 CVE-2015-7577 28105 5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-006987.html 2015-11-27 2016-03-15 View