7.5
CVE-2016-2098
- EPSS 81.45%
- Veröffentlicht 07.04.2016 23:59:06
- Zuletzt bearbeitet 06.05.2026 22:30:45
- Erkennungen
LoginAction Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version 8.0
Rubyonrails ≫ Rails Version 4.0.0 Update -
Rubyonrails ≫ Rails Version 4.0.0 Update beta
Rubyonrails ≫ Rails Version 4.0.0 Update rc1
Rubyonrails ≫ Rails Version 4.0.0 Update rc2
Rubyonrails ≫ Rails Version 4.0.1 Update -
Rubyonrails ≫ Rails Version 4.0.1 Update rc1
Rubyonrails ≫ Rails Version 4.0.1 Update rc2
Rubyonrails ≫ Rails Version 4.0.1 Update rc3
Rubyonrails ≫ Rails Version 4.0.1 Update rc4
Rubyonrails ≫ Rails Version 4.0.2
Rubyonrails ≫ Rails Version 4.0.3
Rubyonrails ≫ Rails Version 4.0.4
Rubyonrails ≫ Rails Version 4.0.4 Update rc1
Rubyonrails ≫ Rails Version 4.0.5
Rubyonrails ≫ Rails Version 4.0.6
Rubyonrails ≫ Rails Version 4.0.6 Update rc1
Rubyonrails ≫ Rails Version 4.0.6 Update rc2
Rubyonrails ≫ Rails Version 4.0.6 Update rc3
Rubyonrails ≫ Rails Version 4.0.7
Rubyonrails ≫ Rails Version 4.0.8
Rubyonrails ≫ Rails Version 4.0.9
Rubyonrails ≫ Rails Version 4.0.10 Update rc1
Rubyonrails ≫ Rails Version 4.1.0 Update -
Rubyonrails ≫ Rails Version 4.1.0 Update beta1
Rubyonrails ≫ Rails Version 4.1.0 Update beta2
Rubyonrails ≫ Rails Version 4.1.0 Update rc1
Rubyonrails ≫ Rails Version 4.1.0 Update rc2
Rubyonrails ≫ Rails Version 4.1.1
Rubyonrails ≫ Rails Version 4.1.2
Rubyonrails ≫ Rails Version 4.1.2 Update rc1
Rubyonrails ≫ Rails Version 4.1.2 Update rc2
Rubyonrails ≫ Rails Version 4.1.2 Update rc3
Rubyonrails ≫ Rails Version 4.1.3
Rubyonrails ≫ Rails Version 4.1.4
Rubyonrails ≫ Rails Version 4.1.5
Rubyonrails ≫ Rails Version 4.1.6 Update rc1
Rubyonrails ≫ Rails Version 4.1.6 Update rc2
Rubyonrails ≫ Rails Version 4.1.7
Rubyonrails ≫ Rails Version 4.1.7.1
Rubyonrails ≫ Rails Version 4.1.8
Rubyonrails ≫ Rails Version 4.1.9 Update rc1
Rubyonrails ≫ Rails Version 4.1.10 Update rc1
Rubyonrails ≫ Rails Version 4.1.10 Update rc2
Rubyonrails ≫ Rails Version 4.1.10 Update rc3
Rubyonrails ≫ Rails Version 4.1.10 Update rc4
Rubyonrails ≫ Rails Version 4.1.12 Update rc1
Rubyonrails ≫ Rails Version 4.1.13 Update rc1
Rubyonrails ≫ Rails Version 4.1.14 Update rc1
Rubyonrails ≫ Rails Version 4.1.14 Update rc2
Rubyonrails ≫ Rails Version 4.2.0 Update beta1
Rubyonrails ≫ Rails Version 4.2.0 Update beta2
Rubyonrails ≫ Rails Version 4.2.0 Update beta3
Rubyonrails ≫ Rails Version 4.2.0 Update beta4
Rubyonrails ≫ Rails Version 4.2.0 Update rc1
Rubyonrails ≫ Rails Version 4.2.0 Update rc2
Rubyonrails ≫ Rails Version 4.2.0 Update rc3
Rubyonrails ≫ Rails Version 4.2.1
Rubyonrails ≫ Rails Version 4.2.1 Update rc1
Rubyonrails ≫ Rails Version 4.2.1 Update rc2
Rubyonrails ≫ Rails Version 4.2.1 Update rc3
Rubyonrails ≫ Rails Version 4.2.1 Update rc4
Rubyonrails ≫ Rails Version 4.2.2
Rubyonrails ≫ Rails Version 4.2.3
Rubyonrails ≫ Rails Version 4.2.3 Update rc1
Rubyonrails ≫ Rails Version 4.2.4
Rubyonrails ≫ Rails Version 4.2.4 Update rc1
Rubyonrails ≫ Rails Version 4.2.5
Rubyonrails ≫ Rails Version 4.2.5 Update rc1
Rubyonrails ≫ Rails Version 4.2.5 Update rc2
Rubyonrails ≫ Rails Version 4.2.5.1
Rubyonrails ≫ Ruby On Rails Version <= 3.2.22.1
Rubyonrails ≫ Ruby On Rails Version 4.1.14.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 81.45% | 0.996 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.3 | 3.9 | 3.4 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
|
| NIST | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/
http://www.debian.org/security/2016/dsa-3509
http://www.securitytracker.com/id/1035122
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html
http://www.securityfocus.com/bid/83725
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ
https://www.exploit-db.com/exploits/40086/