actionpack allows remote attackers to bypass intended access restrictions

HIGH 7.5CVE-2011-0449 · GHSA-4ww3-3rxj-8v6q · Published 21/02/2011 · updated 16/06/2026

Package	Affected versions	Patched versions
actionpack RubyGems	`≥ 3.0.0, < 3.0.4`	`3.0.4`
rails rubyonrails	`= 3.0.0= 3.0.1= 3.0.2= 3.0.3= 3.0.4`	No fix yet

Description

actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.

NVD description

actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.

References

nvd.nist.gov/vuln/detail/CVE-2011-0449 · ADVISORY
rails/rails commit 6f80224 · WEB
rails/rails · PACKAGE
rubysec/ruby-advisory-db · WEB
web.archive.org/web/20201207190612/http://securitytracker.com/id · WEB
groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f · WEB
lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html · WEB
weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4 · WEB
secunia.com/advisories/43278 · Vendor Advisory
securitytracker.com/id
vupen.com/english/advisories/2011/0877

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free