cvelistv5 - cve-2011-0447

cve-2011-0447

Vulnerability from cvelistv5

Published

2011-02-14 20:00

Modified

2024-08-06 21:51

Severity ?

Summary

Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.

References

URL	Tags
cve@mitre.org	http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain	Patch
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
cve@mitre.org	http://secunia.com/advisories/43274
cve@mitre.org	http://secunia.com/advisories/43666
cve@mitre.org	http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails	Patch, Vendor Advisory
cve@mitre.org	http://www.debian.org/security/2011/dsa-2247
cve@mitre.org	http://www.securityfocus.com/bid/46291
cve@mitre.org	http://www.securitytracker.com/id?1025060
cve@mitre.org	http://www.vupen.com/english/advisories/2011/0587
cve@mitre.org	http://www.vupen.com/english/advisories/2011/0877
af854a3a-2127-422b-91ae-364da2661108	http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain	Patch
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/43274
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/43666
af854a3a-2127-422b-91ae-364da2661108	http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.debian.org/security/2011/dsa-2247
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/46291
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id?1025060
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2011/0587
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2011/0877

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:51:09.065Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2011-0587",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0587"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails"
          },
          {
            "name": "1025060",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1025060"
          },
          {
            "name": "FEDORA-2011-2138",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html"
          },
          {
            "name": "46291",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/46291"
          },
          {
            "name": "DSA-2247",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2011/dsa-2247"
          },
          {
            "name": "[rubyonrails-security] 20110209 CSRF Protection Bypass in Ruby on Rails",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain"
          },
          {
            "name": "FEDORA-2011-4358",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"
          },
          {
            "name": "43274",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43274"
          },
          {
            "name": "ADV-2011-0877",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0877"
          },
          {
            "name": "FEDORA-2011-2133",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html"
          },
          {
            "name": "43666",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43666"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-02-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-02-23T10:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "ADV-2011-0587",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0587"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails"
        },
        {
          "name": "1025060",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1025060"
        },
        {
          "name": "FEDORA-2011-2138",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html"
        },
        {
          "name": "46291",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/46291"
        },
        {
          "name": "DSA-2247",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2011/dsa-2247"
        },
        {
          "name": "[rubyonrails-security] 20110209 CSRF Protection Bypass in Ruby on Rails",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain"
        },
        {
          "name": "FEDORA-2011-4358",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"
        },
        {
          "name": "43274",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43274"
        },
        {
          "name": "ADV-2011-0877",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0877"
        },
        {
          "name": "FEDORA-2011-2133",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html"
        },
        {
          "name": "43666",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43666"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-0447",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ADV-2011-0587",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0587"
            },
            {
              "name": "http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails",
              "refsource": "CONFIRM",
              "url": "http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails"
            },
            {
              "name": "1025060",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1025060"
            },
            {
              "name": "FEDORA-2011-2138",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html"
            },
            {
              "name": "46291",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/46291"
            },
            {
              "name": "DSA-2247",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2011/dsa-2247"
            },
            {
              "name": "[rubyonrails-security] 20110209 CSRF Protection Bypass in Ruby on Rails",
              "refsource": "MLIST",
              "url": "http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain"
            },
            {
              "name": "FEDORA-2011-4358",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"
            },
            {
              "name": "43274",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43274"
            },
            {
              "name": "ADV-2011-0877",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0877"
            },
            {
              "name": "FEDORA-2011-2133",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html"
            },
            {
              "name": "43666",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43666"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-0447",
    "datePublished": "2011-02-14T20:00:00",
    "dateReserved": "2011-01-13T00:00:00",
    "dateUpdated": "2024-08-06T21:51:09.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"87B4B121-94BD-4E0F-8860-6239890043B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"63CF211C-683E-4F7D-8C62-05B153AC1960\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:2.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"456A2F7E-CC66-48C4-B028-353D2976837A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:2.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9B1CDAFA-2AC6-4C46-9E65-0BE9127E770F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:2.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F9806A84-2160-40EA-9960-AE7756CE4E0A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:2.2.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07EC67D4-3D0F-4FF9-8197-71175DCB2723\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D1467583-23E9-4E2B-982D-80A356174BB6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DC784C0-5618-4C32-8C17-BE7041656E14\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CFB9ABB5-1F78-4CF0-BA82-7833E0F7A56E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AF3ED96F-3EA4-4E47-A559-9DF9A7D3DDE2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3B38EAA4-E948-45A7-B6E5-7214F2B545E3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E3BE7DFE-BA20-434B-A1DE-AD038B255C60\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*\", \"matchCriteriaId\": \"DCEE5B21-C990-4705-8239-0D7B29DAEDA1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*\", \"matchCriteriaId\": \"65EE33B1-B079-4CDE-B9C2-F1613A4610DC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*\", \"matchCriteriaId\": \"5CAAA20B-824F-4448-99DC-9712FE628073\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*\", \"matchCriteriaId\": \"D2BEBDFB-0F30-454A-B74C-F820C9D2708B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*\", \"matchCriteriaId\": \"1D7CD8C1-95D1-477E-AD96-6582EC33BA01\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"B6F00D98-3D0F-40AF-AE4F-090B1E6B660C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9476CE55-69C0-45D3-B723-6F459C90BF05\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*\", \"matchCriteriaId\": \"486F5BA6-BCF7-4691-9754-19D364B4438D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"112FC73B-A8BC-4EEA-9F4B-CCE685EF2838\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*\", \"matchCriteriaId\": \"E4498383-6FCA-4E17-A1FD-B0CE7EE50F85\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D26565B1-2BA6-4A3C-9264-7FC9A1820B59\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \\\"combinations of browser plugins and HTTP redirects,\\\" a related issue to CVE-2011-0696.\"}, {\"lang\": \"es\", \"value\": \"Ruby on Rails v2.1.x, v2.2.x, and v2.3.x anteriores a v2.3.11,y v3.x anteriores a v3.0.4 no valida correctamente las solicitudes HTTP que contienen una cabecera X-Requested-With, que le hace m\\u00e1s f\\u00e1cil para los atacantes remotos para llevar a cabo una vulnerabilidades de falsificaci\\u00f3n de petici\\u00f3n en sitios cruzados (CSRF) en AJAX o peticiones API, que aprovechan \\\"combinaciones de complementos del navegador y redirecciones\\\" esta relacionado con CVE-2011-0696\"}]",
      "id": "CVE-2011-0447",
      "lastModified": "2024-11-21T01:24:00.103",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2011-02-14T21:00:03.087",
      "references": "[{\"url\": \"http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\"]}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/43274\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/43666\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.debian.org/security/2011/dsa-2247\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/46291\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securitytracker.com/id?1025060\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.vupen.com/english/advisories/2011/0587\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.vupen.com/english/advisories/2011/0877\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/43274\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/43666\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.debian.org/security/2011/dsa-2247\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/46291\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securitytracker.com/id?1025060\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.vupen.com/english/advisories/2011/0587\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.vupen.com/english/advisories/2011/0877\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-352\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2011-0447\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2011-02-14T21:00:03.087\",\"lastModified\":\"2024-11-21T01:24:00.103\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \\\"combinations of browser plugins and HTTP redirects,\\\" a related issue to CVE-2011-0696.\"},{\"lang\":\"es\",\"value\":\"Ruby on Rails v2.1.x, v2.2.x, and v2.3.x anteriores a v2.3.11,y v3.x anteriores a v3.0.4 no valida correctamente las solicitudes HTTP que contienen una cabecera X-Requested-With, que le hace m\u00e1s f\u00e1cil para los atacantes remotos para llevar a cabo una vulnerabilidades de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en AJAX o peticiones API, que aprovechan \\\"combinaciones de complementos del navegador y redirecciones\\\" esta relacionado con CVE-2011-0696\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87B4B121-94BD-4E0F-8860-6239890043B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"63CF211C-683E-4F7D-8C62-05B153AC1960\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:2.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"456A2F7E-CC66-48C4-B028-353D2976837A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:2.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9B1CDAFA-2AC6-4C46-9E65-0BE9127E770F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:2.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F9806A84-2160-40EA-9960-AE7756CE4E0A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:2.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07EC67D4-3D0F-4FF9-8197-71175DCB2723\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1467583-23E9-4E2B-982D-80A356174BB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DC784C0-5618-4C32-8C17-BE7041656E14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CFB9ABB5-1F78-4CF0-BA82-7833E0F7A56E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF3ED96F-3EA4-4E47-A559-9DF9A7D3DDE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B38EAA4-E948-45A7-B6E5-7214F2B545E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3BE7DFE-BA20-434B-A1DE-AD038B255C60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCEE5B21-C990-4705-8239-0D7B29DAEDA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"65EE33B1-B079-4CDE-B9C2-F1613A4610DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CAAA20B-824F-4448-99DC-9712FE628073\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2BEBDFB-0F30-454A-B74C-F820C9D2708B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D7CD8C1-95D1-477E-AD96-6582EC33BA01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6F00D98-3D0F-40AF-AE4F-090B1E6B660C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9476CE55-69C0-45D3-B723-6F459C90BF05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*\",\"matchCriteriaId\":\"486F5BA6-BCF7-4691-9754-19D364B4438D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"112FC73B-A8BC-4EEA-9F4B-CCE685EF2838\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4498383-6FCA-4E17-A1FD-B0CE7EE50F85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D26565B1-2BA6-4A3C-9264-7FC9A1820B59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE\"}]}]}],\"references\":[{\"url\":\"http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/43274\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/43666\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2011/dsa-2247\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/46291\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id?1025060\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2011/0587\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2011/0877\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/43274\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/43666\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2011/dsa-2247\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/46291\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id?1025060\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2011/0587\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2011/0877\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}

ghsa-24fg-p96v-hxh8

Vulnerability from github

Published

2017-10-24 18:33

Modified

2023-05-26 17:41

Summary

actionpack Cross-Site Request Forgery vulnerability

Details

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "actionpack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0"
            },
            {
              "fixed": "2.3.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "actionpack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2011-0447"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:51:22Z",
    "nvd_published_at": "2011-02-14T21:00:03Z",
    "severity": "MODERATE"
  },
  "details": "Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696.",
  "id": "GHSA-24fg-p96v-hxh8",
  "modified": "2023-05-26T17:41:44Z",
  "published": "2017-10-24T18:33:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0447"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da20067af53019bbb034"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/commit/7e86f9b4d2b7dfa974c10ae7e6d8ef90f3d77f06"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rails/rails"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0447.yml"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20170223045008/http://www.securitytracker.com/id?1025060"
    },
    {
      "type": "WEB",
      "url": "http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html"
    },
    {
      "type": "WEB",
      "url": "http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2011/dsa-2247"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "actionpack Cross-Site Request Forgery vulnerability"
}

cve-2011-0447

Vulnerability from fkie_nvd

Published

2011-02-14 21:00

Modified

2024-11-21 01:24

Severity ?

Summary

References

URL	Tags
cve@mitre.org	http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain	Patch
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
cve@mitre.org	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
cve@mitre.org	http://secunia.com/advisories/43274
cve@mitre.org	http://secunia.com/advisories/43666
cve@mitre.org	http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails	Patch, Vendor Advisory
cve@mitre.org	http://www.debian.org/security/2011/dsa-2247
cve@mitre.org	http://www.securityfocus.com/bid/46291
cve@mitre.org	http://www.securitytracker.com/id?1025060
cve@mitre.org	http://www.vupen.com/english/advisories/2011/0587
cve@mitre.org	http://www.vupen.com/english/advisories/2011/0877
af854a3a-2127-422b-91ae-364da2661108	http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain	Patch
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/43274
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/43666
af854a3a-2127-422b-91ae-364da2661108	http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.debian.org/security/2011/dsa-2247
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/46291
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id?1025060
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2011/0587
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2011/0877

Impacted products

Vendor	Product	Version
rubyonrails	rails	2.1.0
rubyonrails	rails	2.1.1
rubyonrails	rails	2.1.2
rubyonrails	rails	2.2.0
rubyonrails	rails	2.2.1
rubyonrails	rails	2.2.2
rubyonrails	rails	2.3.2
rubyonrails	rails	2.3.3
rubyonrails	rails	2.3.4
rubyonrails	rails	2.3.9
rubyonrails	rails	2.3.10
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.1
rubyonrails	rails	3.0.1
rubyonrails	rails	3.0.2
rubyonrails	rails	3.0.2
rubyonrails	rails	3.0.3
rubyonrails	rails	3.0.4

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "87B4B121-94BD-4E0F-8860-6239890043B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "63CF211C-683E-4F7D-8C62-05B153AC1960",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:2.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "456A2F7E-CC66-48C4-B028-353D2976837A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B1CDAFA-2AC6-4C46-9E65-0BE9127E770F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:2.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9806A84-2160-40EA-9960-AE7756CE4E0A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:2.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "07EC67D4-3D0F-4FF9-8197-71175DCB2723",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1467583-23E9-4E2B-982D-80A356174BB6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "4DC784C0-5618-4C32-8C17-BE7041656E14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "CFB9ABB5-1F78-4CF0-BA82-7833E0F7A56E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF3ED96F-3EA4-4E47-A559-9DF9A7D3DDE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B38EAA4-E948-45A7-B6E5-7214F2B545E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3BE7DFE-BA20-434B-A1DE-AD038B255C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "DCEE5B21-C990-4705-8239-0D7B29DAEDA1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "65EE33B1-B079-4CDE-B9C2-F1613A4610DC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "5CAAA20B-824F-4448-99DC-9712FE628073",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "D2BEBDFB-0F30-454A-B74C-F820C9D2708B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*",
              "matchCriteriaId": "1D7CD8C1-95D1-477E-AD96-6582EC33BA01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "B6F00D98-3D0F-40AF-AE4F-090B1E6B660C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9476CE55-69C0-45D3-B723-6F459C90BF05",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*",
              "matchCriteriaId": "486F5BA6-BCF7-4691-9754-19D364B4438D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "112FC73B-A8BC-4EEA-9F4B-CCE685EF2838",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*",
              "matchCriteriaId": "E4498383-6FCA-4E17-A1FD-B0CE7EE50F85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "D26565B1-2BA6-4A3C-9264-7FC9A1820B59",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696."
    },
    {
      "lang": "es",
      "value": "Ruby on Rails v2.1.x, v2.2.x, and v2.3.x anteriores a v2.3.11,y v3.x anteriores a v3.0.4 no valida correctamente las solicitudes HTTP que contienen una cabecera X-Requested-With, que le hace m\u00e1s f\u00e1cil para los atacantes remotos para llevar a cabo una vulnerabilidades de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en AJAX o peticiones API, que aprovechan \"combinaciones de complementos del navegador y redirecciones\" esta relacionado con CVE-2011-0696"
    }
  ],
  "id": "CVE-2011-0447",
  "lastModified": "2024-11-21T01:24:00.103",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2011-02-14T21:00:03.087",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/43274"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/43666"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2011/dsa-2247"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/46291"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1025060"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2011/0587"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2011/0877"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/43274"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/43666"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2011/dsa-2247"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/46291"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1025060"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2011/0587"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2011/0877"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

gsd-2011-0447

Vulnerability from gsd

Modified

2023-12-13 01:19

Details

Aliases

CVE-2011-0447

Aliases

CVE-2011-0447

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2011-0447",
    "description": "Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696.",
    "id": "GSD-2011-0447",
    "references": [
      "https://www.suse.com/security/cve/CVE-2011-0447.html",
      "https://www.debian.org/security/2011/dsa-2247"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2011-0447"
      ],
      "details": "Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696.",
      "id": "GSD-2011-0447",
      "modified": "2023-12-13T01:19:05.032080Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2011-0447",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "ADV-2011-0587",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2011/0587"
          },
          {
            "name": "http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails",
            "refsource": "CONFIRM",
            "url": "http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails"
          },
          {
            "name": "1025060",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id?1025060"
          },
          {
            "name": "FEDORA-2011-2138",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html"
          },
          {
            "name": "46291",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/46291"
          },
          {
            "name": "DSA-2247",
            "refsource": "DEBIAN",
            "url": "http://www.debian.org/security/2011/dsa-2247"
          },
          {
            "name": "[rubyonrails-security] 20110209 CSRF Protection Bypass in Ruby on Rails",
            "refsource": "MLIST",
            "url": "http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain"
          },
          {
            "name": "FEDORA-2011-4358",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"
          },
          {
            "name": "43274",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/43274"
          },
          {
            "name": "ADV-2011-0877",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2011/0877"
          },
          {
            "name": "FEDORA-2011-2133",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html"
          },
          {
            "name": "43666",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/43666"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=2.1.0 \u003c2.3.11||\u003e=3.0.0 \u003c3.0.4",
          "affected_versions": "All versions starting from 2.1.0 before 2.3.11, all versions starting from 3.0.0 before 3.0.4",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "cwe_ids": [
            "CWE-1035",
            "CWE-352",
            "CWE-352",
            "CWE-937"
          ],
          "date": "2023-05-26",
          "description": "Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696.",
          "fixed_versions": [
            "2.3.11",
            "3.0.4"
          ],
          "identifier": "CVE-2011-0447",
          "identifiers": [
            "GHSA-24fg-p96v-hxh8",
            "CVE-2011-0447"
          ],
          "not_impacted": "All versions before 2.1.0, all versions starting from 2.3.11 before 3.0.0, all versions starting from 3.0.4",
          "package_slug": "gem/actionpack",
          "pubdate": "2017-10-24",
          "solution": "Upgrade to versions 2.3.11, 3.0.4 or above.",
          "title": "Cross-Site Request Forgery (CSRF)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2011-0447",
            "http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain",
            "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html",
            "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html",
            "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html",
            "http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails",
            "http://www.debian.org/security/2011/dsa-2247",
            "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0447.yml",
            "https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291",
            "https://web.archive.org/web/20170223045008/http://www.securitytracker.com/id?1025060",
            "https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da20067af53019bbb034",
            "https://github.com/rails/rails/commit/7e86f9b4d2b7dfa974c10ae7e6d8ef90f3d77f06",
            "https://github.com/advisories/GHSA-24fg-p96v-hxh8"
          ],
          "uuid": "a1981ff7-6708-4fdd-a8a3-6866cebb9726"
        },
        {
          "affected_range": "\u003e=2.1.0 \u003c2.3.11||\u003e=3.0.0 \u003c3.0.4",
          "affected_versions": "All versions starting from 2.1.0 before 2.3.11, all versions starting from 3.0.0 before 3.0.4",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "cwe_ids": [
            "CWE-1035",
            "CWE-352",
            "CWE-352",
            "CWE-937"
          ],
          "date": "2021-08-30",
          "description": "Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696.",
          "fixed_versions": [
            "2.3.11",
            "3.0.4"
          ],
          "identifier": "CVE-2011-0447",
          "identifiers": [
            "GHSA-24fg-p96v-hxh8",
            "CVE-2011-0447"
          ],
          "not_impacted": "All versions before 2.1.0, all versions starting from 2.3.11 before 3.0.0, all versions starting from 3.0.4",
          "package_slug": "gem/rails",
          "pubdate": "2017-10-24",
          "solution": "Upgrade to versions 2.3.11, 3.0.4 or above.",
          "title": "Cross-Site Request Forgery (CSRF)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2011-0447",
            "https://github.com/advisories/GHSA-24fg-p96v-hxh8",
            "http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain",
            "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html",
            "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html",
            "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html",
            "http://secunia.com/advisories/43274",
            "http://secunia.com/advisories/43666",
            "http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails",
            "http://www.debian.org/security/2011/dsa-2247",
            "http://www.securityfocus.com/bid/46291",
            "http://www.securitytracker.com/id?1025060",
            "http://www.vupen.com/english/advisories/2011/0587",
            "http://www.vupen.com/english/advisories/2011/0877"
          ],
          "uuid": "d0b20a09-17b4-4a8e-9d07-34f0e6daba65"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:2.1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:2.2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:2.2.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:2.2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-0447"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-352"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[rubyonrails-security] 20110209 CSRF Protection Bypass in Ruby on Rails",
              "refsource": "MLIST",
              "tags": [
                "Patch"
              ],
              "url": "http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source\u0026output=gplain"
            },
            {
              "name": "http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails"
            },
            {
              "name": "43274",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/43274"
            },
            {
              "name": "1025060",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id?1025060"
            },
            {
              "name": "46291",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/46291"
            },
            {
              "name": "43666",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/43666"
            },
            {
              "name": "FEDORA-2011-2138",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html"
            },
            {
              "name": "ADV-2011-0587",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2011/0587"
            },
            {
              "name": "FEDORA-2011-2133",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html"
            },
            {
              "name": "ADV-2011-0877",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2011/0877"
            },
            {
              "name": "FEDORA-2011-4358",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"
            },
            {
              "name": "DSA-2247",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "http://www.debian.org/security/2011/dsa-2247"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        }
      },
      "lastModifiedDate": "2019-08-08T15:41Z",
      "publishedDate": "2011-02-14T21:00Z"
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2011-0447

Vulnerability from cvelistv5

ghsa-24fg-p96v-hxh8

Vulnerability from github

cve-2011-0447

Vulnerability from fkie_nvd

gsd-2011-0447

Vulnerability from gsd

Tags

Sightings

Nomenclature