7.5

CVE-2006-4111

Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rubyonrails ≫ Rails Version0.9.1
Rubyonrails ≫ Rails Version0.9.2
Rubyonrails ≫ Rails Version0.9.3
Rubyonrails ≫ Rails Version0.9.4
Rubyonrails ≫ Rails Version0.9.4.1
Rubyonrails ≫ Rails Version0.10.0
Rubyonrails ≫ Rails Version0.10.1
Rubyonrails ≫ Rails Version0.11.0
Rubyonrails ≫ Rails Version0.11.1
Rubyonrails ≫ Rails Version0.12.0
Rubyonrails ≫ Rails Version0.12.1
Rubyonrails ≫ Rails Version0.13.0
Rubyonrails ≫ Rails Version0.13.1
Rubyonrails ≫ Rails Version0.14.1
Rubyonrails ≫ Rails Version0.14.2
Rubyonrails ≫ Rails Version0.14.3
Rubyonrails ≫ Rails Version0.14.4
Rubyonrails ≫ Rails Version1.0.0
Rubyonrails ≫ Rails Version1.1.0
Rubyonrails ≫ Rails Version1.1.1
Rubyonrails ≫ Rails Version1.1.2
Rubyonrails ≫ Rails Version1.1.3
Rubyonrails ≫ Ruby On Rails Version <= 1.1.4
Rubyonrails ≫ Ruby On Rails Version0.5.0
Rubyonrails ≫ Ruby On Rails Version0.5.5
Rubyonrails ≫ Ruby On Rails Version0.5.6
Rubyonrails ≫ Ruby On Rails Version0.5.7
Rubyonrails ≫ Ruby On Rails Version0.6.0
Rubyonrails ≫ Ruby On Rails Version0.6.5
Rubyonrails ≫ Ruby On Rails Version0.7.0
Rubyonrails ≫ Ruby On Rails Version0.8.0
Rubyonrails ≫ Ruby On Rails Version0.8.5
Rubyonrails ≫ Ruby On Rails Version0.9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.21% 0.803
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://secunia.com/advisories/21749
Vendor Advisory
http://www.novell.com/linux/security/advisories/2006_21_sr.html
http://blog.koehntopp.de/archives/1367-Ruby-On-Rails-Mandatory-Mystery-Patch.html
Patch
http://secunia.com/advisories/21466
Vendor Advisory
http://securitytracker.com/id?1016673
http://weblog.rubyonrails.org/2006/8/9/rails-1-1-5-mandatory-security-patch-and-other-tidbits
Patch
http://www.gentoo.org/security/en/glsa/glsa-200608-20.xml
Patch
Vendor Advisory
http://www.securityfocus.com/bid/19454
Patch
http://www.vupen.com/english/advisories/2006/3237
Vendor Advisory