CVE-2015-3224 in Ruby on Rails
Сводка (Английский)
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
Резервировать
10.04.2015
Раскрытие
26.07.2015
Записи
VulDB provides additional information and datapoints for this CVE:
| ИД | Уязвимость | CWE | Экс | Кон | CVE |
|---|---|---|---|---|---|
| 76812 | Ruby on Rails Web Console request.rb Blacklist эскалация привилегий | 284 | Высокий | Официальное исправление | CVE-2015-3224 |