PT-2016-1365 · Ruby+1 · Ruby On Rails+1

John Backus · Published 2016-01-31 · Updated 2023-05-19 · CVE-2016-0753

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 4.1.x through 4.1.14, Ruby on Rails versions 4.2.x through 4.2.5, Ruby on Rails versions 5.x through 5.0.0.beta1

Description The issue is related to the Active Model component in Ruby on Rails, which supports the use of instance-level writers for class accessors. This allows remote attackers to bypass intended validation steps via crafted parameters.

Recommendations For Ruby on Rails versions 4.1.x through 4.1.14, update to version 4.1.14.1 or later. For Ruby on Rails versions 4.2.x through 4.2.5, update to version 4.2.5.1 or later. For Ruby on Rails versions 5.x through 5.0.0.beta1, update to version 5.0.0.beta1.1 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-00664

CVE-2016-0753

DLA-498-1

DLA-641-1

DLA-642-1

DSA-3464-1

GHSA-543V-GJ2C-R3CH

GHSA-V543-GQHH-6GWW

RHSA-2016:0296

SUSE-SU-2016:0432-1

SUSE-SU-2016:0435-1

SUSE-SU-2016:0458-1

SUSE-SU-2016:0597-1

SUSE-SU-2016:0598-1

SUSE-SU-2016:0600-1

SUSE-SU-2016:1146-1

Affected Products

Ruby On Rails

Suse

References · 69

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activemodel/CVE-2016-0753.yml · Exploit
• http://rhn.redhat.com/errata/RHSA-2016-0296.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-0753 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178047.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1146-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178066.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:0598-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0753 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178065.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:0435-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:0458-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v543-gqhh-6gww · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-0753 · Security Note