Vulnerability advisory

CVE-2016-2098

Published Apr 7, 2016Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/rails/rails ↗
375d9a0a7fb329b0fbbd75a13e93e53a00520587 through bb382b7aee116446518ca4ed1c6472d6b58f42b5	No fix listed
Also listed as affected (70) `4.0.0-NA` `4.0.0-beta` `4.0.0-rc1` `4.0.0-rc2` `4.0.1-NA` `4.0.1-rc1` `4.0.1-rc2` `4.0.1-rc3` `4.0.1-rc4` `4.0.10-rc1` `4.0.2` `4.0.3` `4.0.4` `4.0.4-rc1` `4.0.5` `4.0.6` `4.0.6-rc1` `4.0.6-rc2` `4.0.6-rc3` `4.0.7` `4.0.8` `4.0.9` `4.1.0-NA` `4.1.0-beta1` `4.1.0-beta2` `4.1.0-rc1` `4.1.0-rc2` `4.1.1` `4.1.10-rc1` `4.1.10-rc2` `4.1.10-rc3` `4.1.10-rc4` `4.1.12-rc1` `4.1.13-rc1` `4.1.14-rc1` `4.1.14-rc2` `4.1.2` `4.1.2-rc1` `4.1.2-rc2` `4.1.2-rc3` `4.1.3` `4.1.4` `4.1.5` `4.1.6-rc1` `4.1.6-rc2` `4.1.7` `4.1.7.1` `4.1.8` `4.1.9-rc1` `4.2.0-beta1` `4.2.0-beta2` `4.2.0-beta3` `4.2.0-beta4` `4.2.0-rc1` `4.2.0-rc2` `4.2.0-rc3` `4.2.1` `4.2.1-rc1` `4.2.1-rc2` `4.2.1-rc3` `4.2.1-rc4` `4.2.2` `4.2.3` `4.2.3-rc1` `4.2.4` `4.2.4-rc1` `4.2.5` `4.2.5-rc1` `4.2.5-rc2` `4.2.5.1`

Description

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

CVE-2016-2098

Affected versions

Repository

Description

References