Read the docs
TI-2008-04940 Aliases CVE-2008-5189GHSA-jmgf-p46x-982h

CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to…

Priority LOW 26CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.

Why it matters now

EPSS 0.01533 74th percentileScored 2026-11-07
Fix Fixed rails (RubyGems): 2.0.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—rails (RubyGems)before 2.0.52.0.5Patch availableGHSA-jmgf-p46x-982h
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • rails (RubyGems) Vendor— Affected before 2.0.5 Fixed in 2.0.5 Patch available GHSA-jmgf-p46x-982h

CPE configurations NVD · 49

CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:0.9.1:*:*:*:*:*:*:*0.9.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.9.2:*:*:*:*:*:*:*0.9.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.9.3:*:*:*:*:*:*:*0.9.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.9.4:*:*:*:*:*:*:*0.9.4VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.9.4.1:*:*:*:*:*:*:*0.9.4.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.10.0:*:*:*:*:*:*:*0.10.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.10.1:*:*:*:*:*:*:*0.10.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.11.0:*:*:*:*:*:*:*0.11.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.11.1:*:*:*:*:*:*:*0.11.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.12.0:*:*:*:*:*:*:*0.12.0VulnerableRails
  • cpe:2.3:a:rubyonrails:rails:0.9.1:*:*:*:*:*:*:* Versions 0.9.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.9.2:*:*:*:*:*:*:* Versions 0.9.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.9.3:*:*:*:*:*:*:* Versions 0.9.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.9.4:*:*:*:*:*:*:* Versions 0.9.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.9.4.1:*:*:*:*:*:*:* Versions 0.9.4.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.10.0:*:*:*:*:*:*:* Versions 0.10.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.10.1:*:*:*:*:*:*:* Versions 0.10.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.11.0:*:*:*:*:*:*:* Versions 0.11.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.11.1:*:*:*:*:*:*:* Versions 0.11.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.12.0:*:*:*:*:*:*:* Versions 0.12.0 Vulnerable ·Rails
Show 39 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:0.12.1:*:*:*:*:*:*:*0.12.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.13.0:*:*:*:*:*:*:*0.13.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.13.1:*:*:*:*:*:*:*0.13.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.14.1:*:*:*:*:*:*:*0.14.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.14.2:*:*:*:*:*:*:*0.14.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.14.3:*:*:*:*:*:*:*0.14.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:0.14.4:*:*:*:*:*:*:*0.14.4VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.1.3:*:*:*:*:*:*:*1.1.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.1.4:*:*:*:*:*:*:*1.1.4VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.1.5:*:*:*:*:*:*:*1.1.5VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.1.6:*:*:*:*:*:*:*1.1.6VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.2.0:*:*:*:*:*:*:*1.2.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.2.3:*:*:*:*:*:*:*1.2.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.2.4:*:*:*:*:*:*:*1.2.4VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.2.5:*:*:*:*:*:*:*1.2.5VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.2.6:*:*:*:*:*:*:*1.2.6VulnerableRails
cpe:2.3:a:rubyonrails:rails:1.9.5:*:*:*:*:*:*:*1.9.5VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.0.0:rc1:*:*:*:*:*:*2.0.0 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.0.0:rc2:*:*:*:*:*:*2.0.0 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*up to 2.0.4VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.0:*:*:*:*:*:*:*0.5.0VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.5:*:*:*:*:*:*:*0.5.5VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.6:*:*:*:*:*:*:*0.5.6VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.7:*:*:*:*:*:*:*0.5.7VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.0:*:*:*:*:*:*:*0.6.0VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.5:*:*:*:*:*:*:*0.6.5VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:0.7.0:*:*:*:*:*:*:*0.7.0VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.0:*:*:*:*:*:*:*0.8.0VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.5:*:*:*:*:*:*:*0.8.5VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:0.9.0:*:*:*:*:*:*:*0.9.0VulnerableRails
  • cpe:2.3:a:rubyonrails:rails:0.12.1:*:*:*:*:*:*:* Versions 0.12.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.13.0:*:*:*:*:*:*:* Versions 0.13.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.13.1:*:*:*:*:*:*:* Versions 0.13.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.14.1:*:*:*:*:*:*:* Versions 0.14.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.14.2:*:*:*:*:*:*:* Versions 0.14.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.14.3:*:*:*:*:*:*:* Versions 0.14.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:0.14.4:*:*:*:*:*:*:* Versions 0.14.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.1.5:*:*:*:*:*:*:* Versions 1.1.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.1.6:*:*:*:*:*:*:* Versions 1.1.6 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.2.5:*:*:*:*:*:*:* Versions 1.2.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.2.6:*:*:*:*:*:*:* Versions 1.2.6 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:1.9.5:*:*:*:*:*:*:* Versions 1.9.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:* Versions up to 2.0.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.0:*:*:*:*:*:*:* Versions 0.5.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.5:*:*:*:*:*:*:* Versions 0.5.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.6:*:*:*:*:*:*:* Versions 0.5.6 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.7:*:*:*:*:*:*:* Versions 0.5.7 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.0:*:*:*:*:*:*:* Versions 0.6.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.5:*:*:*:*:*:*:* Versions 0.6.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:0.7.0:*:*:*:*:*:*:* Versions 0.7.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.0:*:*:*:*:*:*:* Versions 0.8.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.5:*:*:*:*:*:*:* Versions 0.8.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:0.9.0:*:*:*:*:*:*:* Versions 0.9.0 Vulnerable ·Rails

Remediation

  • Fix · GHSA-jmgf-p46x-982h rails (RubyGems) Fixed in 2.0.5 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-5189
  2. 2026-10-03 Alias added: GHSA-jmgf-p46x-982h

References

Advisory 3

Other 4

  • TI-2014-00124 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03828 Path traversal in Rails https://github.com/rails/rails KEVCVSS 3.1HIGH 7.5
  • TI-2016-00672 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03830 Command injection in Rails https://github.com/rails/rails CVSS 3.1CRITICAL 9.8
  • TI-2020-06581 Code injection in https://github.com/rails/rails CVSS 3.1HIGH 8.8
  • TI-2013-00091 active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before… CVSS 2.0HIGH 7.5
See all 117 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences