CVE-2011-2929: Input Validation
A flaw in the template selection code in Ruby on Rails >=3.0 could allow an attacker to render a view they should not have access to [1]. This is corrected in 3.0.10 and 3.1.0rc6, patches are available in the advisory [1] and in git [2].
[1] http://groups.google.com/group/rubyonrails-security/browsethread/thread/3420ac71aed312d6 [2] https://github.com/rails/rails/commit/5f94b93279f6d0682fafb237c301302c107a9552
Other sources
The template selection functionality in actionpack/lib/actionview/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2929?
CVE-2011-2929 has a medium severity rating as it allows unauthorized access to application views.
How do I fix CVE-2011-2929?
To fix CVE-2011-2929, upgrade Ruby on Rails to version 3.0.10, 3.1.0, or later.
What versions are affected by CVE-2011-2929?
CVE-2011-2929 affects Ruby on Rails versions from 3.0.0 to 3.0.9, including multiple beta and release candidates.
Is CVE-2011-2929 an injection vulnerability?
No, CVE-2011-2929 is a flaw in the template selection code, not an injection vulnerability.
What is the potential impact of CVE-2011-2929?
The potential impact of CVE-2011-2929 includes unauthorized information disclosure by rendering protected views.