Test Kennung:	1.3.6.1.4.1.25623.1.0.809358
Kategorie:	Web application abuses
Titel:	Ruby on Rails Acrive Record Security Bypass Vulnerability (Windows)
Zusammenfassung:	Ruby on Rails is prone to security bypass vulnerabilities.
Beschreibung:	Summary: Ruby on Rails is prone to security bypass vulnerabilities. Vulnerability Insight: The flaw is due to the script 'activerecord/lib/active_record/nested_attributes.rb' does not properly implement a certain destroy option. Vulnerability Impact: Successful exploitation will allow a remote attacker to bypass intended change restrictions by leveraging use of the nested attributes feature. Affected Software/OS: Ruby on Rails before 3.1.x and 3.2.x before 3.2.22.1, Ruby on Rails 4.0.x and 4.1.x before 4.1.14.1 and Ruby on Rails 4.2.x before 4.2.5.1 on Windows. Solution: Upgrade to Ruby on Rails 3.2.22.1 or 4.1.14.1 or 4.2.5.1, or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Querverweis:	BugTraq ID: 81806 Common Vulnerability Exposure (CVE) ID: CVE-2015-7577 http://www.securityfocus.com/bid/81806 Debian Security Information: DSA-3464 (Google Search) http://www.debian.org/security/2016/dsa-3464 http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178041.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178065.html http://www.openwall.com/lists/oss-security/2016/01/25/10 https://groups.google.com/forum/message/raw?msg=ruby-security-ann/cawsWcQ6c8g/LATIsglZEgAJ RedHat Security Advisories: RHSA-2016:0296 http://rhn.redhat.com/errata/RHSA-2016-0296.html http://www.securitytracker.com/id/1034816 SuSE Security Announcement: SUSE-SU-2016:1146 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html SuSE Security Announcement: openSUSE-SU-2016:0363 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html SuSE Security Announcement: openSUSE-SU-2016:0372 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
Copyright	Copyright (C) 2016 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.