Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-4ww3-3rxj-8v6q
Advisory ID github_osv/GHSA-4ww3-3rxj-8v6q
Aliases CVE-2011-0449
Summary actionpack allows remote attackers to bypass intended access restrictions `actionpack/lib/action_view/template/resolver.rb` in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
generic_textual HIGH
Reference id Reference type URL
http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
https://github.com/rails/rails/commit/6f80224057803f85b3f448936aae89e742452c3b
https://github.com/rails/rails/tree/main/actionpack
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0449.yml
https://web.archive.org/web/20201207190612/http://securitytracker.com/id?1025061
http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
CVE-2011-0449 https://nvd.nist.gov/vuln/detail/CVE-2011-0449

No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

There are no SSVC decisions available.