{"api_version":"1","generated_at":"2026-07-23T04:49:12+00:00","cve":"CVE-2011-0449","urls":{"html":"https://cve.report/CVE-2011-0449","api":"https://cve.report/api/cve/CVE-2011-0449.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-0449","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-0449"},"summary":{"title":"CVE-2011-0449","description":"actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.","state":"PUBLISHED","assigner":"mitre","published_at":"2011-02-21 18:00:01","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://secunia.com/advisories/43278","name":"http://secunia.com/advisories/43278","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Ruby on Rails Filter Bypass and SQL Injection Vulnerabilities - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2011/0877","name":"http://www.vupen.com/english/advisories/2011/0877","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail - OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[SECURITY] Fedora 15 Update: rubygem-rails-3.0.5-2.fc15","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain","name":"http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Google Groups","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4","name":"http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Riding Rails: New Releases: 2.3.11 and 3.0.4","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1025061","name":"http://securitytracker.com/id?1025061","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Ruby on Rails Bug Lets Remote Users Bypass Filters on Case-Insensitive Filesystems - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-0449","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0449","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rubyonrails","cpe5":"rails","cpe6":"3.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rubyonrails","cpe5":"rails","cpe6":"3.0.0","cpe7":"beta","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rubyonrails","cpe5":"rails","cpe6":"3.0.0","cpe7":"beta2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rubyonrails","cpe5":"rails","cpe6":"3.0.0","cpe7":"beta3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rubyonrails","cpe5":"rails","cpe6":"3.0.0","cpe7":"beta4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rubyonrails","cpe5":"rails","cpe6":"3.0.0","cpe7":"rc","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rubyonrails","cpe5":"rails","cpe6":"3.0.0","cpe7":"rc2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rubyonrails","cpe5":"rails","cpe6":"3.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rubyonrails","cpe5":"rails","cpe6":"3.0.1","cpe7":"pre","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rubyonrails","cpe5":"rails","cpe6":"3.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rubyonrails","cpe5":"rails","cpe6":"3.0.2","cpe7":"pre","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rubyonrails","cpe5":"rails","cpe6":"3.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"rubyonrails","cpe5":"rails","cpe6":"3.0.4","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T21:51:09.091Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1025061","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1025061"},{"name":"[rubyonrails-security] 20110209 Filter Problems on Case-Insensitive Filesystems","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4"},{"name":"FEDORA-2011-4358","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"},{"name":"43278","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/43278"},{"name":"ADV-2011-0877","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2011/0877"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2011-02-09T00:00:00.000Z","descriptions":[{"lang":"en","value":"actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2011-04-21T09:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"1025061","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1025061"},{"name":"[rubyonrails-security] 20110209 Filter Problems on Case-Insensitive Filesystems","tags":["mailing-list","x_refsource_MLIST"],"url":"http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain"},{"tags":["x_refsource_CONFIRM"],"url":"http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4"},{"name":"FEDORA-2011-4358","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"},{"name":"43278","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/43278"},{"name":"ADV-2011-0877","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2011/0877"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2011-0449","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1025061","refsource":"SECTRACK","url":"http://securitytracker.com/id?1025061"},{"name":"[rubyonrails-security] 20110209 Filter Problems on Case-Insensitive Filesystems","refsource":"MLIST","url":"http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain"},{"name":"http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4","refsource":"CONFIRM","url":"http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4"},{"name":"FEDORA-2011-4358","refsource":"FEDORA","url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"},{"name":"43278","refsource":"SECUNIA","url":"http://secunia.com/advisories/43278"},{"name":"ADV-2011-0877","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2011/0877"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2011-0449","datePublished":"2011-02-21T17:00:00.000Z","dateReserved":"2011-01-13T00:00:00.000Z","dateUpdated":"2024-08-06T21:51:09.091Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2011-02-21 18:00:01","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*","matchCriteriaId":"E3BE7DFE-BA20-434B-A1DE-AD038B255C60"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*","matchCriteriaId":"DCEE5B21-C990-4705-8239-0D7B29DAEDA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*","matchCriteriaId":"65EE33B1-B079-4CDE-B9C2-F1613A4610DC"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*","matchCriteriaId":"5CAAA20B-824F-4448-99DC-9712FE628073"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*","matchCriteriaId":"D2BEBDFB-0F30-454A-B74C-F820C9D2708B"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*","matchCriteriaId":"1D7CD8C1-95D1-477E-AD96-6582EC33BA01"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*","matchCriteriaId":"B6F00D98-3D0F-40AF-AE4F-090B1E6B660C"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*","matchCriteriaId":"9476CE55-69C0-45D3-B723-6F459C90BF05"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*","matchCriteriaId":"486F5BA6-BCF7-4691-9754-19D364B4438D"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*","matchCriteriaId":"112FC73B-A8BC-4EEA-9F4B-CCE685EF2838"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*","matchCriteriaId":"E4498383-6FCA-4E17-A1FD-B0CE7EE50F85"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*","matchCriteriaId":"D26565B1-2BA6-4A3C-9264-7FC9A1820B59"},{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*","matchCriteriaId":"644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"449","Ordinal":"1","Title":"CVE-2011-0449","CVE":"CVE-2011-0449","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"449","Ordinal":"1","NoteData":"actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.","Type":"Description","Title":"CVE-2011-0449"},{"CveYear":"2011","CveId":"449","Ordinal":"2","NoteData":"2011-02-21","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"449","Ordinal":"3","NoteData":"2011-04-21","Type":"Other","Title":"Modified"}]}}}