{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2011-02-09T00:00:00", "descriptions": [{"lang": "en", "value": "actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2011-04-21T09:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "1025061", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1025061"}, {"name": "[rubyonrails-security] 20110209 Filter Problems on Case-Insensitive Filesystems", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4"}, {"name": "FEDORA-2011-4358", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"}, {"name": "43278", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/43278"}, {"name": "ADV-2011-0877", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2011/0877"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2011-0449", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "1025061", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1025061"}, {"name": "[rubyonrails-security] 20110209 Filter Problems on Case-Insensitive Filesystems", "refsource": "MLIST", "url": "http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain"}, {"name": "http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4", "refsource": "CONFIRM", "url": "http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4"}, {"name": "FEDORA-2011-4358", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"}, {"name": "43278", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/43278"}, {"name": "ADV-2011-0877", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2011/0877"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2011-0449", "datePublished": "2011-02-21T17:00:00", "dateReserved": "2011-01-13T00:00:00", "dateUpdated": "2011-04-21T09:00:00", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "E3BE7DFE-BA20-434B-A1DE-AD038B255C60", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*", "matchCriteriaId": "DCEE5B21-C990-4705-8239-0D7B29DAEDA1", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "65EE33B1-B079-4CDE-B9C2-F1613A4610DC", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "5CAAA20B-824F-4448-99DC-9712FE628073", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "D2BEBDFB-0F30-454A-B74C-F820C9D2708B", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*", "matchCriteriaId": "1D7CD8C1-95D1-477E-AD96-6582EC33BA01", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "B6F00D98-3D0F-40AF-AE4F-090B1E6B660C", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "9476CE55-69C0-45D3-B723-6F459C90BF05", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*", "matchCriteriaId": "486F5BA6-BCF7-4691-9754-19D364B4438D", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "112FC73B-A8BC-4EEA-9F4B-CCE685EF2838", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*", "matchCriteriaId": "E4498383-6FCA-4E17-A1FD-B0CE7EE50F85", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "D26565B1-2BA6-4A3C-9264-7FC9A1820B59", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*", "matchCriteriaId": "644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters."}, {"lang": "es", "value": "actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x anteriores a v3.0.4, cuando un sistema de ficheros sensible a may\u00fasculas y min\u00fasculas se utiliza, no se aplican adecuadamente los filtros asociados a la lista de plantillas disponibles, lo que permite a atacantes remotos evitar las restricciones de acceso previsto a trav\u00e9s de un nombre de acci\u00f3n que utiliza un caso no deseado para los caracteres alfab\u00e9ticos."}], "id": "CVE-2011-0449", "lastModified": "2019-08-08T15:41:32.003", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2011-02-21T18:00:01.363", "references": [{"source": "cve@mitre.org", "url": "http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain"}, {"source": "cve@mitre.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/43278"}, {"source": "cve@mitre.org", "url": "http://securitytracker.com/id?1025061"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2011/0877"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}