CVE-2011-3187

The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

6.67% chance of exploitation in the next 30 days, 93th percentile

Published

2011-08-29

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/35352

References

• CVE Record
• NVD entry

Related

• CVE-2011-3183
• CVE-2011-3192
• CVE-2011-3182
• CVE-2011-3200
• CVE-2011-3176
• CVE-2011-3202