Rails activerecord gem has Improper Input Validation vulnerability (GHSA-gjxw-5w2q-7grf)
Published: 2017-10-24T18:33:38Z
Aliases: CVE-2010-3933
Severity: MODERATE · CWE: CWE-20

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.

Affected packages:
package: ecosystem: RubyGems
name: activerecord
ranges: type: ECOSYSTEM
events: introduced: 2.3.9
fixed: 2.3.10
package: ecosystem: RubyGems
name: activerecord
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.1