Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and previous versions do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote malicious users to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
ruby-lang ruby 1.8.7 |
||
ruby-lang ruby 1.9.2 |
Vulmon