CVE-2013-0276: Circumvention of attr_protected

February 12, 2013 (updated August 8, 2019)

The attr_protected method allows developers to specify a denylist of model attributes which users should not be allowed to assign to. By using a specially crafted request, attackers could circumvent this protection and alter values that were meant to be protected.

References

groups.google.com/forum/?fromgroups=

Code Behaviors & Features

Detect and mitigate CVE-2013-0276 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →