actionpack allows remote code execution via application's unrestricted use of render method
High severity
GitHub Reviewed
Published
Oct 24, 2017
to the GitHub Advisory Database
•
Updated Jul 3, 2023
Package
Affected versions
>= 3.0.0, <= 3.2.22.1
>= 4.0.0, <= 4.1.14.1
>= 4.2.0, <= 4.2.5.1
Patched versions
3.2.22.2
4.1.14.2
4.2.5.2
Description
Published to the GitHub Advisory Database
Oct 24, 2017
Reviewed
Jun 16, 2020
Last updated
Jul 3, 2023
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
References