Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-0276)

Description

ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.

Remediation

References

CVE-2013-0276

Related Vulnerabilities

Oracle Application Server CVE-2008-0348 Vulnerability (CVE-2008-0348)

Envoy Proxy Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2023-27493)

WordPress Plugin Consulting Elementor Widgets SQL Injection (1.3.0)

Atlassian Jira Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-2928)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-4747)

Severity

Medium

Classification

CVE-2013-0276 CWE-264