CVE-2008-5189: CSRF
Published Nov 21, 2008
·Updated
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirectto function.
Affected Software
50 affected componentsFixes available
rubyonrails ruby on Rails=0.8.0
rubyonrails ruby on Rails=0.5.7
rubyonrails ruby on Rails=0.7.0
rubyonrails Rails=1.2.4
rubyonrails ruby on Rails=0.8.5
rubyonrails ruby on Rails=0.6.0
rubyonrails ruby on Rails=0.5.6
rubyonrails ruby on Rails=0.9.0
rubyonrails ruby on Rails=0.5.5
rubyonrails ruby on Rails=0.5.0
rubyonrails ruby on Rails=0.6.5
rubyonrails ruby on Rails<=2.0.4
rubyonrails Rails=0.9.1
rubyonrails Rails=0.9.2
rubyonrails Rails=0.9.3
rubyonrails Rails=0.9.4
rubyonrails Rails=0.9.4.1
rubyonrails Rails=0.10.0
rubyonrails Rails=0.10.1
rubyonrails Rails=0.11.0
rubyonrails Rails=0.11.1
rubyonrails Rails=0.12.0
rubyonrails Rails=0.12.1
rubyonrails Rails=0.13.0
rubyonrails Rails=0.13.1
rubyonrails Rails=0.14.1
rubyonrails Rails=0.14.2
rubyonrails Rails=0.14.3
rubyonrails Rails=0.14.4
rubyonrails Rails=1.0.0
rubyonrails Rails=1.1.1
rubyonrails Rails=1.1.2
rubyonrails Rails=1.1.3
rubyonrails Rails=1.1.4
rubyonrails Rails=1.1.5
rubyonrails Rails=1.1.6
rubyonrails Rails=1.2.1
rubyonrails Rails=1.2.2
rubyonrails Rails=1.2.3
rubyonrails Rails=1.2.5
rubyonrails Rails=1.2.6
rubyonrails Rails=1.9.5
rubyonrails Rails=1.1.0
rubyonrails Rails=1.2.0
rubyonrails Rails=2.0.1
rubyonrails Rails=2.0.2
rubyonrails Rails=2.0.0-rc1
rubyonrails Rails=2.0.0-rc2
rubyonrails Rails=2.0.0
rubygems/rails<2.0.5
2.0.5
Remediation
Patch Available
Event History
Nov 21, 2008
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Oct 24, 2017
Advisory Published
via GitHub·06:33 PM
Data Sourced
via GitHub·06:33 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2008-5189?
CVE-2008-5189 has a medium severity rating due to its potential for HTTP response splitting attacks.
2
How do I fix CVE-2008-5189?
To fix CVE-2008-5189, upgrade Ruby on Rails to version 2.0.5 or later.
3
What are the affected versions for CVE-2008-5189?
CVE-2008-5189 affects Ruby on Rails versions prior to 2.0.5, including all versions from 0.9.1 to 2.0.4.
4
What kind of attacks can be conducted due to CVE-2008-5189?
CVE-2008-5189 allows attackers to conduct HTTP response splitting attacks by injecting arbitrary HTTP headers.
5
Is CVE-2008-5189 easy to exploit?
CVE-2008-5189 can be exploited easily if an attacker can manipulate URLs passed to the redirect_to function.