CVE-2010-3933: Input Validation
Published Oct 27, 2010
·Updated
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
Affected Software
4 affected componentsFixes available
rubygems/activerecord>=3.0.0<3.0.1
3.0.1
rubygems/activerecord>=2.3.9<2.3.10
2.3.10
rubyonrails Rails=2.3.9
rubyonrails Rails=3.0.0
Event History
Oct 27, 2010
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Oct 24, 2017
Advisory Published
06:33 PM
Frequently Asked Questions
1
What is the severity of CVE-2010-3933?
CVE-2010-3933 is classified as a high severity vulnerability due to the potential for remote attackers to modify arbitrary records.
2
How do I fix CVE-2010-3933?
You can fix CVE-2010-3933 by upgrading to Ruby on Rails version 2.3.10 or 3.0.1.
3
Which versions of Ruby on Rails are affected by CVE-2010-3933?
CVE-2010-3933 affects Ruby on Rails versions 2.3.9 and 3.0.0.
4
What type of vulnerability is CVE-2010-3933?
CVE-2010-3933 is a vulnerability related to improper handling of nested attributes in Ruby on Rails.
5
Can CVE-2010-3933 be exploited remotely?
Yes, CVE-2010-3933 can be exploited remotely, allowing attackers to change parameter names to modify records.