CVE-2010-3933

EUVD-2017-0240
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.4 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
Affected Products (NVD)
VendorProductVersion
rubyonrailsrails
2.3.9
rubyonrailsrails
3.0.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
rails
bookworm
2:6.1.7.3+dfsg-2~deb12u1
fixed
bullseye
2:6.0.3.7+dfsg-2+deb11u2
fixed
bullseye (security)
2:6.0.3.7+dfsg-2+deb11u2
fixed
sid
2:6.1.7.3+dfsg-4
fixed
trixie
2:6.1.7.3+dfsg-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
rails
dapper
not-affected
hardy
not-affected
karmic
not-affected
lucid
not-affected
maverick
not-affected
Common Weakness Enumeration
References
http://secunia.com/advisories/41930
http://securitytracker.com/id?1024624
http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0
http://www.vupen.com/english/advisories/2010/2719
http://secunia.com/advisories/41930
http://securitytracker.com/id?1024624
http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0
http://www.vupen.com/english/advisories/2010/2719