{"id":"CVE-2011-0447","published":"2011-02-14T20:00:00Z","modified":"2024-08-06T21:51:09Z","title":"Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests…","vendor":null,"product":null,"tier":"tail","description":{"text":"Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01418,"percentile":0.727,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.vupen.com/english/advisories/2011/0587","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id?1025060","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.securityfocus.com/bid/46291","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.debian.org/security/2011/dsa-2247","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://secunia.com/advisories/43274","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2011/0877","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://secunia.com/advisories/43666","tags":["third-party-advisory","x_refsource_SECUNIA"]}],"priority":{"score":14.5,"factors":[{"name":"EPSS percentile","points":14.54}]},"affected":[{"ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=2.1.0, <2.3.11",">=3.0.0, <3.0.4"],"patched":["2.3.11","3.0.4"],"from":["GHSA-24fg-p96v-hxh8"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-0148","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-actionpack-cve-2011-0447","children":[{"from":"CVE-2011-0447","to":"CVE-2012-2694","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["actionpack/lib/action_dispatch/http/request.rb"],"commits":["https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da20067af53019bbb034","https://github.com/rails/rails/commit/7e86f9b4d2b7dfa974c10ae7e6d8ef90f3d77f06","https://github.com/rails/rails/commit/2f3bc0467311781ac1ceb2c8c2b09002c8fe143a","https://github.com/rails/rails/commit/c202638225519b5e1a03ebe523b109c948fb0e52"],"basis":"rarely changed file"}]},{"from":"CVE-2011-0447","to":"CVE-2011-0696","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"…which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696.","from":"CVE.org","in":"CVE-2011-0447"}]}],"packageHistory":[{"cve":"CVE-2011-3186","published":"2011-08-29","fixed":"2.3.13","kev":false},{"cve":"CVE-2011-3187","published":"2011-08-29","fixed":"2.3.13","kev":false},{"cve":"CVE-2011-0446","published":"2011-02-14","fixed":"3.0.4","kev":false},{"cve":"CVE-2011-0447","published":"2011-02-14","fixed":"3.0.4","kev":false},{"cve":"CVE-2011-0449","published":"2011-02-21","fixed":"3.0.4","kev":false},{"cve":"CVE-2011-1497","published":"2021-10-19","fixed":"3.0.6","kev":false},{"cve":"CVE-2011-2197","published":"2011-06-30","fixed":"3.0.8","kev":false,"link":{"from":"CVE-2011-0447","to":"CVE-2011-2197","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"2.3.11","toFixed":"2.3.12","daysApart":136}]}}],"package":"RubyGems:actionpack"}}