Read the docs
TI-2012-02953 Aliases CVE-2012-3424GHSA-92w9-2pqw-rhjj

The decode_credentials method in…

Priority LOW 27CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method.

Why it matters now

EPSS 0.01889 79th percentileScored 2026-11-07
Fix Fixed actionpack (RubyGems): 3.0.16, 3.1.7, 3.2.7 +1Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—actionpack (RubyGems)3.0.0.beta to before 3.0.163.0.16Patch availableGHSA-92w9-2pqw-rhjj
—actionpack (RubyGems)3.1.0 to before 3.1.73.1.7Patch availableGHSA-92w9-2pqw-rhjj
—actionpack (RubyGems)3.2.0 to before 3.2.73.2.7Patch availableGHSA-92w9-2pqw-rhjj
—actionpack (RubyGems)before 2.3.52.3.5Patch availableGHSA-92w9-2pqw-rhjj
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • actionpack (RubyGems) Vendor— Affected 3.0.0.beta to before 3.0.16 Fixed in 3.0.16 Patch available GHSA-92w9-2pqw-rhjj
  • actionpack (RubyGems) Vendor— Affected 3.1.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-92w9-2pqw-rhjj
  • actionpack (RubyGems) Vendor— Affected 3.2.0 to before 3.2.7 Fixed in 3.2.7 Patch available GHSA-92w9-2pqw-rhjj
  • actionpack (RubyGems) Vendor— Affected before 2.3.5 Fixed in 2.3.5 Patch available GHSA-92w9-2pqw-rhjj

CPE configurations NVD · 77

CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*3.0.0 betaVulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*3.0.0 beta2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*3.0.0 beta3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*3.0.0 beta4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*3.0.0 rcVulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*3.0.0 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*3.0.1 preVulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableRails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:* Versions 3.0.0 beta Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:* Versions 3.0.0 beta2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:* Versions 3.0.0 beta3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:* Versions 3.0.0 beta4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:* Versions 3.0.0 rc Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:* Versions 3.0.0 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:* Versions 3.0.1 pre Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Rails
Show 67 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*3.0.2 preVulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*3.0.4 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*3.0.5 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*3.0.6VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*3.0.6 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*3.0.6 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*3.0.7VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*3.0.7 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*3.0.7 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*3.0.8VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*3.0.8 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*3.0.8 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*3.0.8 rc3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*3.0.8 rc4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*3.0.9VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*3.0.9 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*3.0.9 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*3.0.9 rc3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*3.0.9 rc4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*3.0.9 rc5VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*3.0.10VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*3.0.10 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*3.0.11VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*3.0.12VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*3.0.12 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*3.0.13VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*3.0.13 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*3.0.14VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*3.1.0 beta1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*3.1.0 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*3.1.0 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*3.1.0 rc3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*3.1.0 rc4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*3.1.0 rc5VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*3.1.0 rc6VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*3.1.0 rc7VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*3.1.0 rc8VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*3.1.1 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*3.1.1 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*3.1.1 rc3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*3.1.2 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*3.1.2 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*3.1.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*3.1.4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*3.1.4 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*3.1.5VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*3.1.5 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*3.1.6VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*3.2.0 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*3.2.0 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*3.2.2 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*3.2.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*3.2.3 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*3.2.3 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*3.2.4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*3.2.4 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*3.2.5VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*3.2.6VulnerableRails
  • cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:* Versions 3.0.2 pre Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:* Versions 3.0.4 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:* Versions 3.0.5 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:* Versions 3.0.6 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:* Versions 3.0.6 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:* Versions 3.0.7 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:* Versions 3.0.7 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:* Versions 3.0.8 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:* Versions 3.0.8 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:* Versions 3.0.8 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:* Versions 3.0.8 rc3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:* Versions 3.0.8 rc4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:* Versions 3.0.9 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:* Versions 3.0.9 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:* Versions 3.0.9 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:* Versions 3.0.9 rc3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:* Versions 3.0.9 rc4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:* Versions 3.0.9 rc5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:* Versions 3.0.10 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:* Versions 3.0.10 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:* Versions 3.0.11 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:* Versions 3.0.12 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:* Versions 3.0.12 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:* Versions 3.0.13 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:* Versions 3.0.13 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:* Versions 3.0.14 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:* Versions 3.1.0 beta1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:* Versions 3.1.0 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:* Versions 3.1.0 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:* Versions 3.1.0 rc3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:* Versions 3.1.0 rc4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:* Versions 3.1.0 rc5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:* Versions 3.1.0 rc6 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:* Versions 3.1.0 rc7 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:* Versions 3.1.0 rc8 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:* Versions 3.1.1 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:* Versions 3.1.1 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:* Versions 3.1.1 rc3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:* Versions 3.1.2 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:* Versions 3.1.2 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:* Versions 3.1.4 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:* Versions 3.1.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:* Versions 3.1.5 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:* Versions 3.1.6 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:* Versions 3.2.0 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:* Versions 3.2.0 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:* Versions 3.2.2 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:* Versions 3.2.3 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:* Versions 3.2.3 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:* Versions 3.2.4 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:* Versions 3.2.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:* Versions 3.2.6 Vulnerable ·Rails

Remediation

  • Fix · GHSA-92w9-2pqw-rhjj actionpack (RubyGems) Fixed in 3.0.16 Advisory →
  • Fix · GHSA-92w9-2pqw-rhjj actionpack (RubyGems) Fixed in 3.1.7 Advisory →
  • Fix · GHSA-92w9-2pqw-rhjj actionpack (RubyGems) Fixed in 3.2.7 Advisory →
  • Fix · GHSA-92w9-2pqw-rhjj actionpack (RubyGems) Fixed in 2.3.5 Advisory →

Red Hat 3 advisories

  • RHSA-2013:0582 Released 2013-02-28 · Red Hat rating Moderate
    Red Hat OpenShift Enterprise 1.1.1 update
    • Red Hat OpenShift Enterprise Infrastructure graphviz-2.26.0-10.el6, graphviz-devel-2.26.0-10.el6, graphviz-doc-2.26.0-10.el6 +42
    • Red Hat OpenShift Enterprise JBoss EAP add-on openshift-origin-cartridge-jbosseap-6.0-1.0.4-1.el6op
    • Red Hat OpenShift Enterprise Node openshift-origin-cartridge-cron-1.4-1.0.3-1.el6op, openshift-origin-cartridge-diy-0.1-1.0.3-1.el6op, openshift-origin-cartridge-haproxy-1.4-1.0.4-1.el6op +46
  • RHSA-2013:0154 Released 2013-01-10 · Red Hat rating Critical
    Ruby on Rails security update
    • Red Hat Subscription Asset Manager for RHEL 6 Server rubygem-actionpack-1:3.0.10-11.el6cf, rubygem-activerecord-1:3.0.10-8.el6cf, rubygem-activesupport-1:3.0.10-5.el6cf
  • RHSA-2012:1542 Released 2012-12-04 · Red Hat rating Moderate
    CloudForms Commons 1.1 security update
    • CloudForms Cloud Engine for RHEL 6 Server converge-ui-devel-1.0.4-1.el6cf, puppet-2.6.17-2.el6cf, puppet-server-2.6.17-2.el6cf +13
    • CloudForms System Engine for RHEL 6 Server converge-ui-devel-1.0.4-1.el6cf, puppet-2.6.17-2.el6cf, puppet-server-2.6.17-2.el6cf +13

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Cloud Engine for RHEL 6 ServerFixed RHSA-2012:1542
CloudForms System Engine for RHEL 6 ServerFixed RHSA-2012:1542
Red Hat OpenShift Enterprise InfrastructureFixed RHSA-2013:0582
Red Hat OpenShift Enterprise JBoss EAP add-onFixed RHSA-2013:0582
Red Hat OpenShift Enterprise NodeFixed RHSA-2013:0582
Red Hat Subscription Asset Manager for RHEL 6 ServerFixed RHSA-2013:0154

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-3424
  2. 2026-10-03 Alias added: GHSA-92w9-2pqw-rhjj

References

Advisory 3

Other 5

  • TI-2014-00124 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03828 Path traversal in Rails https://github.com/rails/rails KEVCVSS 3.1HIGH 7.5
  • TI-2016-00672 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03830 Command injection in Rails https://github.com/rails/rails CVSS 3.1CRITICAL 9.8
  • TI-2020-06581 Code injection in https://github.com/rails/rails CVSS 3.1HIGH 8.8
  • TI-2013-00091 active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before… CVSS 2.0HIGH 7.5
See all 117 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences