Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ypcy-hry9-5fa3
Vulnerability ID VCID-ypcy-hry9-5fa3
Aliases CVE-2011-0449
GHSA-4ww3-3rxj-8v6q
Summary High severity vulnerability that affects actionpack actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-264 Permissions, Privileges, and Access Controls
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual HIGH http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain
generic_textual HIGH http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
epss 0.00555 https://api.first.org/data/v1/epss?cve=CVE-2011-0449
generic_textual HIGH https://github.com/rails/rails/commit/6f80224057803f85b3f448936aae89e742452c3b
generic_textual HIGH https://github.com/rails/rails/tree/main/actionpack
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0449.yml
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2011-0449
generic_textual HIGH https://web.archive.org/web/20201207190612/http://securitytracker.com/id?1025061
generic_textual HIGH http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
Reference id Reference type URL
http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
https://api.first.org/data/v1/epss?cve=CVE-2011-0449
http://secunia.com/advisories/43278
http://securitytracker.com/id?1025061
https://github.com/rails/rails/commit/6f80224057803f85b3f448936aae89e742452c3b
https://github.com/rails/rails/tree/main/actionpack
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0449.yml
https://web.archive.org/web/20201207190612/http://securitytracker.com/id?1025061
http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
http://www.vupen.com/english/advisories/2011/0877
CVE-2011-0449 https://nvd.nist.gov/vuln/detail/CVE-2011-0449
GHSA-4ww3-3rxj-8v6q https://github.com/advisories/GHSA-4ww3-3rxj-8v6q
GLSA-201412-28 https://security.gentoo.org/glsa/201412-28
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.68473
EPSS Score 0.00555
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:37:18.253227+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionpack/CVE-2011-0449.yml 38.6.0