{"id":"GHSA-24fg-p96v-hxh8","summary":"actionpack Cross-Site Request Forgery vulnerability","details":"Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696.","aliases":["CVE-2011-0447"],"modified":"2024-12-07T05:38:37.003705Z","published":"2017-10-24T18:33:38Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2020-06-16T20:51:22Z","nvd_published_at":"2011-02-14T21:00:03Z","cwe_ids":["CWE-352"],"severity":"MODERATE"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0447"},{"type":"WEB","url":"https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da20067af53019bbb034"},{"type":"WEB","url":"https://github.com/rails/rails/commit/7e86f9b4d2b7dfa974c10ae7e6d8ef90f3d77f06"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0447.yml"},{"type":"WEB","url":"https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291"},{"type":"WEB","url":"https://web.archive.org/web/20170223045008/http://www.securitytracker.com/id?1025060"},{"type":"WEB","url":"http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html"},{"type":"WEB","url":"http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails"},{"type":"WEB","url":"http://www.debian.org/security/2011/dsa-2247"}],"affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.3.11"}]}],"versions":["2.1.0","2.1.1","2.1.2","2.2.2","2.2.3","2.3.10","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-24fg-p96v-hxh8/GHSA-24fg-p96v-hxh8.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.4"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4.rc1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-24fg-p96v-hxh8/GHSA-24fg-p96v-hxh8.json"}}],"schema_version":"1.9.0"}