CVE-2011-2929

The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does…

published August 29, 2011

CVSS
—
EPSS
2%
Percentile
78.4
In the wild
Unconfirmed
What it is

The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01813 · 78.4th percentile
Published
2011-08-29T18:00Z
EPSS history
Timeline
  • 29 AUG 18:00Z
    The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does…
    cvelistv5