Ruby on Rails Nested Attributes Security Bypass Vulnerability

Bugtraq ID:	44124
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2010-3933
Remote:	Yes
Local:	No
Published:	Oct 15 2010 12:00AM
Updated:	Dec 16 2014 07:58AM
Credit:	The vendor reported this issue.
Vulnerable:	Ruby on Rails Ruby on Rails 3.0 Ruby on Rails Ruby on Rails 2.3.9 Gentoo Linux
Not Vulnerable:	Ruby on Rails Ruby on Rails 3.0.1 Ruby on Rails Ruby on Rails 2.3.10

Ruby on Rails Nested Attributes Security Bypass Vulnerability

Ruby on Rails is prone to a security-bypass vulnerability.

An attacker can exploit the issue to bypass certain security restrictions and perform unauthorized actions.

Ruby on Rails versions 3.0.0 and 2.3.9 are vulnerable.

Ruby on Rails Nested Attributes Security Bypass Vulnerability

Attackers can exploit this issue using browser.

Ruby on Rails Nested Attributes Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Ruby on Rails Nested Attributes Security Bypass Vulnerability

References:

• Ruby on Rails Homepage (Ruby on Rails)
  
• Vulnerability in Nested Attributes code in Ruby On Rails 2.3.9 and 3.0.0 (Ruby On Rails)