vulnwire
7.3high

CVE-2016-2098in critical feed1 exploit

actionpack allows remote code execution via application's unrestricted use of render method

Also known as GHSA-78rc-8c29-p45g

Published 10 y ago · modified 4 mo ago · JSON

CVSS
7.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
81.4%
percentile 100%
Public exploits
1
Exploit-DB

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Exploit prediction (EPSS)

81.45% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-40086 Ruby on Rails ActionPack Inline ERB - Code Execution (Metasploit) · remote · 2016-07-11

CVSS scores

Assigned byVersionScoreVector
NVD3.07.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.07.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

EcosystemPackageAffectedFixed in
rubygemsactionpack
>=3.0.0, <3.2.22.2
>=4.0.0, <4.1.14.2
>=4.2.0, <4.2.5.2
3.2.22.2
4.1.14.2
4.2.5.2

Classification

Weakness
  • CWE-20 Improper Input Validation
Technology feeds
Ruby on Rails (RSS, critical only)

References

  • lists.opensuse.org /opensuse-security-announce/2016-03/msg00086.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-04/msg00006.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • debian.org /security/2016/dsa-3509 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securityfocus.com /bid/83725 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1035122 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • exploit-db.com /exploits/40086/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-03/msg00083.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-03/msg00057.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-04/msg00053.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-03/msg00080.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • groups.google.com /forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ · mailing-list, x_refsource_MLIST, x_transferred
  • weblog.rubyonrails.org /2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/ · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-2098 · advisory
  • github.com /rails/rails · package
  • github.com /rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-2098.yml · web
  • groups.google.com /forum/#!topic/rubyonrails-security/ly-IH-fxr_Q · web
  • web.archive.org /web/20200228015318/http://www.securityfocus.com/bid/83725 · web
  • web.archive.org /web/20210612214217/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/l · web
  • web.archive.org /web/20211205173437/https://securitytracker.com/id/1035122 · web
  • exploit-db.com /exploits/40086 · web
  • weblog.rubyonrails.org /2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.