This host is running Ruby on Rails and is prone to security bypass vulnerability.

Successful exploitation will allow attackers to manipulate arbitrary records. Impact Level: Application

Upgrade to Ruby On Rails version 3.0.1 or 2.3.10 For updates refer to http://rubyonrails.org/download

The flaw is due to an input validation error when handling nested attributes, which can be exploited to manipulate arbitrary records by changing form input parameter names.

Ruby on Rails versions 2.3.9 and 3.0.0

• http://secunia.com/advisories/41930
• http://securitytracker.com/id?1024624
• http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0
• http://www.vupen.com/english/advisories/2010/2719

---

Updated on 2015-03-25