Description

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.

Remediation

References

CVE-2010-3933

Related Vulnerabilities

PHP NULL Pointer Dereference Vulnerability (CVE-2016-9934)

WordPress Plugin Shortcode Ninja Cross-Site Scripting (1.4)

Envoy Proxy Use After Free Vulnerability (CVE-2024-39305)

Atlassian Jira Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2008-6531)

Moodle Insufficient Verification of Data Authenticity Vulnerability (CVE-2024-43428)

Severity

Medium

Classification

CVE-2010-3933 CWE-20

Tags

Missing Update Known Vulnerabilities