CVE-2010-3933

Description

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.

References

https://github.com/advisories/GHSA-gjxw-5w2q-7grf

https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-0240

http://www.vupen.com/english/advisories/2010/2719

http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0

http://securitytracker.com/id?1024624

http://secunia.com/advisories/41930

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS