CVE-2011-0447
CVE-2011-0447
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.
EPSS 1,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
n/a
- Versiones
- n/a: Afectada
Sin corrección publicada
rails Debian:12
- Intervalos de versiones afectados
- ECOSYSTEM: < 2.3.11-0.1
Actualiza a 2.3.11-0.1
rails Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 2.3.11-0.1
Actualiza a 2.3.11-0.1
rails Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 2.3.11-0.1
Actualiza a 2.3.11-0.1
Fuentes originales
- http://www.vupen.com/english/advisories/2011/0587
- http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
- http://www.securitytracker.com/id?1025060
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
- http://www.securityfocus.com/bid/46291
- http://www.debian.org/security/2011/dsa-2247
- http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
- http://secunia.com/advisories/43274
- http://www.vupen.com/english/advisories/2011/0877
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
- http://secunia.com/advisories/43666
- https://nvd.nist.gov/vuln/detail/CVE-2011-0447