NVD

Id
7513  
Name
CVE-2011-0449  
Description
actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2011-02-21  
Modified Date
2012-07-06  
Seq
2011-0449  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
42386 7513 CVE-2011-0449 [rubyonrails-security] 20110209 Filter Problems on Case-Insensitive Filesystems  View
42387 7513 CVE-2011-0449 FEDORA-2011-4358  View
42388 7513 CVE-2011-0449 1025061  View
42389 7513 CVE-2011-0449 http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4  View
42390 7513 CVE-2011-0449 ADV-2011-0877  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
33884 JVNDB-2011-004126 Ruby on Rails の actionpack/lib/action_view/template/resolver.rb におけるアクセス制限を回避する脆弱性 Ruby on Rails の actionpack/lib/action_view/template/resolver.rb は、大文字小文字を区別しないファイルシステムが使用されている際、有効なテンプレートのリストに関連するフィルタを適切に実装しないため、アクセス制限を回避する脆弱性が存在します。 CVE-2011-0449 48356 CVE-2011-0449 7513 7.5 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004126.html 2011-02-08 2012-03-27 View