CVE-2010-3933
medium
CVSS v3
—
CVSS v2
6.4
VIR risk
6.4
Description
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2010-3933
Vendor advisory: cve@mitre.org — http://www.vupen.com/english/advisories/2010/2719
Vendor advisory: cve@mitre.org — http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0
Vendor advisory: cve@mitre.org — http://secunia.com/advisories/41930
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 0 |
| debian | bullseye | fixed | 0 |
| debian | forky | fixed | 0 |
| debian | sid | fixed | 0 |
| debian | trixie | fixed | 0 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| RubyGems | activerecord | !< 2.3.9||<~> 2.3.9 | ~> 2.3.9 |
| RubyGems | activerecord | >=2.3.9,<2.3.10 | 2.3.10 |
| RubyGems | activerecord | >=3.0.0,<3.0.1 | 3.0.1 |
References
- http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0
- http://secunia.com/advisories/41930
- http://securitytracker.com/id?1024624
- http://www.vupen.com/english/advisories/2010/2719
- https://nvd.nist.gov/vuln/detail/CVE-2010-3933
- https://github.com/rails/rails/commit/2d96bccb1e8b62e3e11ca0c5d38aaa8cece889ae
- https://github.com/rails/rails/commit/96183e0f284bab27667e5a38fa6a1578eb029585
- https://github.com/rails/rails
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2010-3933.yml
- https://web.archive.org/web/20101129225633/http://securitytracker.com/alerts/2010/Oct/1024624.html
- https://web.archive.org/web/20111225083933/http://secunia.com/advisories/41930
- https://web.archive.org/web/20201208053819/http://securitytracker.com/id?1024624
- https://security-tracker.debian.org/tracker/CVE-2010-3933
CWEs
CWE-20
Verify integrity in audit chain (admin only). AS-IS.