search

uriel-naor / ISSUES

0 stars 0 forks source link

rails-3.0.7.gem: 53 vulnerabilities (highest severity is: 10.0) - autoclosed #13

Closed uriel-mend-app[bot] closed 1 year ago

uriel-mend-app[bot] commented 1 year ago
Vulnerable Library - rails-3.0.7.gem

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Library home page: https://rubygems.org/gems/rails-3.0.7.gem

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (rails version) Remediation Available
CVE-2013-0277 High 10.0 activerecord-3.0.7.gem Transitive N/A* ❌
CVE-2020-8184 High 7.5 rack-1.2.3.gem Transitive N/A* ❌
CVE-2021-22885 High 7.5 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2012-2695 High 7.5 activerecord-3.0.7.gem Transitive N/A* ❌
CVE-2019-5418 High 7.5 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2016-0752 High 7.5 rails-3.0.7.gem Direct 3.2.22.1,4.1.14.1,4.2.5.1,5.0.0.beta1.1 ❌
CVE-2016-0751 High 7.5 detected in multiple dependencies Direct 3.2.22.1,4.1.14.1,4.2.5.1,5.0.0.beta1.1 ❌
CVE-2014-10077 High 7.5 i18n-0.5.0.gem Transitive N/A* ❌
CVE-2013-0156 High 7.3 activesupport-3.0.7.gem Transitive N/A* ❌
CVE-2012-6496 High 7.3 activerecord-3.0.7.gem Transitive N/A* ❌
CVE-2016-2098 High 7.3 detected in multiple dependencies Transitive N/A* ❌
CVE-2013-0333 High 7.3 activesupport-3.0.7.gem Transitive N/A* ❌
CVE-2014-3482 High 7.3 activerecord-3.0.7.gem Transitive N/A* ❌
CVE-2012-2140 High 7.3 mail-2.2.19.gem Transitive N/A* ❌
CVE-2013-6417 Medium 6.5 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2013-3221 Medium 6.5 activerecord-3.0.7.gem Transitive N/A* ❌
CVE-2013-0155 Medium 6.5 activerecord-3.0.7.gem Transitive N/A* ❌
CVE-2012-2660 Medium 6.5 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2020-8167 Medium 6.5 rails-3.0.7.gem Direct 6.0.3.1,5.2.4.3 ❌
CVE-2010-3299 Medium 6.5 rails-3.0.7.gem Direct rails - 5.2.0.beta1 ❌
CVE-2020-8130 Medium 6.4 rake-0.9.0.gem Transitive N/A* ❌
CVE-2018-16471 Medium 6.1 rack-1.2.3.gem Transitive N/A* ❌
CVE-2016-6316 Medium 6.1 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2015-9097 Medium 6.1 mail-2.2.19.gem Transitive N/A* ❌
CVE-2019-16782 Medium 5.9 rack-1.2.3.gem Transitive N/A* ❌
WS-2017-0283 Medium 5.5 rack-1.2.3.gem Transitive N/A* ❌
CVE-2013-6414 Medium 5.3 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2012-3424 Medium 5.3 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2012-2139 Medium 5.3 mail-2.2.19.gem Transitive N/A* ❌
CVE-2012-2661 Medium 5.3 activerecord-3.0.7.gem Transitive N/A* ❌
CVE-2020-8161 Medium 5.3 rack-1.2.3.gem Transitive N/A* ❌
CVE-2016-2097 Medium 5.3 rails-3.0.7.gem Direct 3.2.22.2,4.1.14.2 ❌
CVE-2011-2929 Medium 5.3 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2014-0082 Medium 5.3 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2013-0263 Medium 5.1 rack-1.2.3.gem Transitive N/A* ❌
CVE-2011-5036 Medium 5.0 rack-1.2.3.gem Transitive N/A* ❌
CVE-2015-3225 Medium 5.0 rack-1.2.3.gem Transitive N/A* ❌
CVE-2012-6109 Medium 4.3 rack-1.2.3.gem Transitive N/A* ❌
CVE-2013-0184 Medium 4.3 rack-1.2.3.gem Transitive N/A* ❌
CVE-2011-2197 Low 3.7 rails-3.0.7.gem Direct 2.3.12,3.0.8,3.1.0.rc2 ❌
CVE-2013-6415 Low 3.7 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2012-3463 Low 3.7 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2012-3465 Low 3.7 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2012-3464 Low 3.7 activesupport-3.0.7.gem Transitive N/A* ❌
CVE-2013-1855 Low 3.7 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2013-1857 Low 3.7 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2011-2932 Low 3.7 rails-3.0.7.gem Direct 2.3.13,3.0.10,3.1.0.rc5 ❌
CVE-2012-1099 Low 3.7 rails-3.0.7.gem Direct 3.0.12,3.1.4,3.2.2 ❌
CVE-2013-4491 Low 3.7 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2013-4492 Low 3.7 i18n-0.5.0.gem Transitive N/A* ❌
CVE-2014-0130 Low 3.7 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2015-7576 Low 3.7 actionpack-3.0.7.gem Transitive N/A* ❌
CVE-2014-0081 Low 3.7 actionpack-3.0.7.gem Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

Partial details (24 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2013-0277 ### Vulnerable Library - activerecord-3.0.7.gem

Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.

Library home page: https://rubygems.org/gems/activerecord-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **activerecord-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.

Publish Date: 2013-02-13

URL: CVE-2013-0277

### CVSS 2 Score Details (10.0)

Base Score Metrics not available

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2013-0277

Release Date: 2013-02-13

Fix Resolution: 2.3.17,3.1.0

CVE-2020-8184 ### Vulnerable Library - rack-1.2.3.gem

Rack provides minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call. Also see http://rack.rubyforge.org.

Library home page: https://rubygems.org/gems/rack-1.2.3.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - railties-3.0.7.gem - actionpack-3.0.7.gem - :x: **rack-1.2.3.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

Publish Date: 2020-06-19

URL: CVE-2020-8184

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://groups.google.com/forum/#!topic/rubyonrails-security/OWtmozPH9Ak

Release Date: 2020-06-17

Fix Resolution: rack - 2.1.4, 2.2.3

CVE-2021-22885 ### Vulnerable Library - actionpack-3.0.7.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **actionpack-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.

Publish Date: 2021-05-27

URL: CVE-2021-22885

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-hjg4-8q5f-x6fm

Release Date: 2021-05-27

Fix Resolution: actionpack - 5.2.4.6,5.2.6,6.0.3.7,6.1.3.2

CVE-2012-2695 ### Vulnerable Library - activerecord-3.0.7.gem

Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.

Library home page: https://rubygems.org/gems/activerecord-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **activerecord-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.

Publish Date: 2012-06-22

URL: CVE-2012-2695

### CVSS 2 Score Details (7.5)

Base Score Metrics not available

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-2695

Release Date: 2012-06-22

Fix Resolution: 3.0.14,3.1.6,3.2.6

CVE-2019-5418 ### Vulnerable Library - actionpack-3.0.7.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **actionpack-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

Publish Date: 2019-03-27

URL: CVE-2019-5418

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/

Release Date: 2019-01-04

Fix Resolution: 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1

CVE-2016-0752 ### Vulnerable Library - rails-3.0.7.gem

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Library home page: https://rubygems.org/gems/rails-3.0.7.gem

Dependency Hierarchy: - :x: **rails-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

Publish Date: 2016-02-16

URL: CVE-2016-0752

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-0752

Release Date: 2016-02-16

Fix Resolution: 3.2.22.1,4.1.14.1,4.2.5.1,5.0.0.beta1.1

CVE-2016-0751 ### Vulnerable Libraries - rails-3.0.7.gem, actionpack-3.0.7.gem

### rails-3.0.7.gem

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Library home page: https://rubygems.org/gems/rails-3.0.7.gem

Dependency Hierarchy: - :x: **rails-3.0.7.gem** (Vulnerable Library) ### actionpack-3.0.7.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **actionpack-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.

Publish Date: 2016-02-16

URL: CVE-2016-0751

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-0751

Release Date: 2016-02-16

Fix Resolution: 3.2.22.1,4.1.14.1,4.2.5.1,5.0.0.beta1.1

CVE-2014-10077 ### Vulnerable Library - i18n-0.5.0.gem

New wave Internationalization support for Ruby.

Library home page: https://rubygems.org/gems/i18n-0.5.0.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - activeresource-3.0.7.gem - activemodel-3.0.7.gem - :x: **i18n-0.5.0.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (application crash) via a call in a situation where :some_key is present in keep_keys but not present in the hash.

Publish Date: 2018-11-06

URL: CVE-2014-10077

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-10077

Release Date: 2018-11-06

Fix Resolution: 0.8.0

CVE-2013-0156 ### Vulnerable Library - activesupport-3.0.7.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Library home page: https://rubygems.org/gems/activesupport-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **activesupport-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

Publish Date: 2013-01-14

URL: CVE-2013-0156

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2013-0156

Release Date: 2013-01-14

Fix Resolution: 2.3.15,3.0.19,3.1.10,3.2.11

CVE-2012-6496 ### Vulnerable Library - activerecord-3.0.7.gem

Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.

Library home page: https://rubygems.org/gems/activerecord-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **activerecord-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.

Publish Date: 2013-01-04

URL: CVE-2012-6496

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6496

Release Date: 2013-01-04

Fix Resolution: 3.0.18,3.1.9,3.2.10

CVE-2016-2098 ### Vulnerable Libraries - actionpack-3.0.7.gem, rails-3.0.7.gem

### actionpack-3.0.7.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **actionpack-3.0.7.gem** (Vulnerable Library) ### rails-3.0.7.gem

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Library home page: https://rubygems.org/gems/rails-3.0.7.gem

Dependency Hierarchy: - :x: **rails-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Publish Date: 2016-04-08

URL: CVE-2016-2098

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-2098

Release Date: 2016-04-08

Fix Resolution: 3.2.22.2,4.1.14.2,4.2.5.2

CVE-2013-0333 ### Vulnerable Library - activesupport-3.0.7.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Library home page: https://rubygems.org/gems/activesupport-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **activesupport-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.

Publish Date: 2013-01-30

URL: CVE-2013-0333

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2013-0333

Release Date: 2013-01-30

Fix Resolution: 2.3.16,3.0.20

CVE-2014-3482 ### Vulnerable Library - activerecord-3.0.7.gem

Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.

Library home page: https://rubygems.org/gems/activerecord-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **activerecord-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.

Publish Date: 2014-07-07

URL: CVE-2014-3482

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-3482

Release Date: 2014-07-07

Fix Resolution: 3.2.19

CVE-2012-2140 ### Vulnerable Library - mail-2.2.19.gem

A really Ruby Mail handler.

Library home page: https://rubygems.org/gems/mail-2.2.19.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - actionmailer-3.0.7.gem - :x: **mail-2.2.19.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.

Publish Date: 2012-07-18

URL: CVE-2012-2140

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-2140

Release Date: 2012-07-18

Fix Resolution: 2.4.3

CVE-2013-6417 ### Vulnerable Library - actionpack-3.0.7.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **actionpack-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

Publish Date: 2013-12-07

URL: CVE-2013-6417

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2013-6417

Release Date: 2013-12-07

Fix Resolution: 3.2.16,4.0.2

CVE-2013-3221 ### Vulnerable Library - activerecord-3.0.7.gem

Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.

Library home page: https://rubygems.org/gems/activerecord-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **activerecord-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.

Publish Date: 2013-04-22

URL: CVE-2013-3221

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3221

Release Date: 2013-04-22

Fix Resolution: 4.0.0.rc1

CVE-2013-0155 ### Vulnerable Library - activerecord-3.0.7.gem

Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.

Library home page: https://rubygems.org/gems/activerecord-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **activerecord-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.

Publish Date: 2013-01-14

URL: CVE-2013-0155

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2013-0155

Release Date: 2013-01-14

Fix Resolution: 3.0.19,3.1.10,3.2.11

CVE-2012-2660 ### Vulnerable Library - actionpack-3.0.7.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **actionpack-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.

Publish Date: 2012-06-22

URL: CVE-2012-2660

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-2660

Release Date: 2012-06-22

Fix Resolution: 3.0.13,3.1.5,3.2.4

CVE-2020-8167 ### Vulnerable Library - rails-3.0.7.gem

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Library home page: https://rubygems.org/gems/rails-3.0.7.gem

Dependency Hierarchy: - :x: **rails-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.

Publish Date: 2020-06-19

URL: CVE-2020-8167

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://rubygems.org/gems/rails/versions/6.0.3.1

Release Date: 2020-06-19

Fix Resolution: 6.0.3.1,5.2.4.3

CVE-2010-3299 ### Vulnerable Library - rails-3.0.7.gem

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Library home page: https://rubygems.org/gems/rails-3.0.7.gem

Dependency Hierarchy: - :x: **rails-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.

Publish Date: 2019-11-12

URL: CVE-2010-3299

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3299

Release Date: 2019-11-12

Fix Resolution: rails - 5.2.0.beta1

CVE-2020-8130 ### Vulnerable Library - rake-0.9.0.gem

Rake is a Make-like program implemented in Ruby. Tasks and dependencies are specified in standard Ruby syntax.

Library home page: https://rubygems.org/gems/rake-0.9.0.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - railties-3.0.7.gem - :x: **rake-0.9.0.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.

Publish Date: 2020-02-24

URL: CVE-2020-8130

### CVSS 3 Score Details (6.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: High - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8130

Release Date: 2020-02-24

Fix Resolution: v12.3.3

CVE-2018-16471 ### Vulnerable Library - rack-1.2.3.gem

Rack provides minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call. Also see http://rack.rubyforge.org.

Library home page: https://rubygems.org/gems/rack-1.2.3.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - railties-3.0.7.gem - actionpack-3.0.7.gem - :x: **rack-1.2.3.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.

Publish Date: 2018-11-13

URL: CVE-2018-16471

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://groups.google.com/forum/#!topic/rubyonrails-security/GKsAFT924Ag

Fix Resolution: 2.0.6, 1.6.11

CVE-2016-6316 ### Vulnerable Library - actionpack-3.0.7.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-3.0.7.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - :x: **actionpack-3.0.7.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.

Publish Date: 2016-09-07

URL: CVE-2016-6316

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-6316

Release Date: 2016-09-07

Fix Resolution: 3.2.22.3,4.2.7.1,5.0.0.1

CVE-2015-9097 ### Vulnerable Library - mail-2.2.19.gem

A really Ruby Mail handler.

Library home page: https://rubygems.org/gems/mail-2.2.19.gem

Dependency Hierarchy: - rails-3.0.7.gem (Root Library) - actionmailer-3.0.7.gem - :x: **mail-2.2.19.gem** (Vulnerable Library)

Found in HEAD commit: b524dd26cead2f970d1b2cad363a2709409599da

Found in base branch: main

### Vulnerability Details

The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.

Publish Date: 2017-06-12

URL: CVE-2015-9097

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9097

Release Date: 2017-06-12

Fix Resolution: 2.5.5

uriel-mend-app[bot] commented 1 year ago

:information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #15