Description

The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."

Remediation

References

CVE-2011-2929

Related Vulnerabilities

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce SQL Injection (4.3.0)

Oracle Application Server CVE-2009-1017 Vulnerability (CVE-2009-1017)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-28034)

WordPress Plugin Connections Business Directory Unspecified Vulnerability (10.4.7)

WordPress Plugin Monsters Editor for WP Super Edit Arbitrary File Upload (1.1)

Severity

Medium

Classification

CVE-2011-2929 CWE-20

Tags

Missing Update Known Vulnerabilities