Homepage

Improper Input Validation The advisory has been revoked - it doesn't affect any version of package ruby-actionpack-2.3  (opens in a new tab)

Threat Intelligence

EPSS
7.16% (94th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1204-RUBYACTIONPACK23-623477
  • published16 Feb 2016
  • disclosed16 Feb 2016
Report a new vulnerability Found a mistake?

Introduced: 16 Feb 2016

CVE-2016-0753  (opens in a new tab)
CWE-20  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:12.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ruby-actionpack-2.3 package and not the ruby-actionpack-2.3 package as distributed by Ubuntu.

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

References