CVE-2011-0447: Cross-Site Request Forgery (CSRF)
(updated )
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage “combinations of browser plugins and HTTP redirects,” a related issue to CVE-2011-0696.
References
- groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain
- lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
- lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html
- lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
- secunia.com/advisories/43274
- secunia.com/advisories/43666
- weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails
- www.debian.org/security/2011/dsa-2247
- www.securityfocus.com/bid/46291
- www.securitytracker.com/id?1025060
- www.vupen.com/english/advisories/2011/0587
- www.vupen.com/english/advisories/2011/0877
- github.com/advisories/GHSA-24fg-p96v-hxh8
- nvd.nist.gov/vuln/detail/CVE-2011-0447
Code Behaviors & Features
Detect and mitigate CVE-2011-0447 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →