7.5
CVSSv3

CVE-2015-7581

Published: 16/02/2016 Updated: 08/08/2019
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x prior to 4.2.5.1 and 5.x prior to 5.0.0.beta1.1 allows remote malicious users to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.

Vulnerable Product Search on Vulmon Subscribe to Product

rubyonrails rails 5.0.0

rubyonrails rails 4.2.5

rubyonrails rails 4.1.7

rubyonrails rails 4.1.6

rubyonrails rails 4.1.5

rubyonrails rails 4.1.1

rubyonrails rails 4.1.0

rubyonrails rails 4.0.6

rubyonrails rails 4.0.1

rubyonrails rails 4.2.0

rubyonrails rails 4.1.8

rubyonrails rails 4.1.2

rubyonrails rails 4.0.10

rubyonrails rails 4.0.0

rubyonrails rails 4.2.4

rubyonrails rails 4.2.3

rubyonrails rails 4.1.4

rubyonrails rails 4.1.3

rubyonrails rails 4.0.9

rubyonrails rails 4.0.5

rubyonrails rails 4.0.4

rubyonrails rails 4.2.2

rubyonrails rails 4.2.1

rubyonrails rails 4.0.8

rubyonrails rails 4.0.7

rubyonrails rails 4.0.3

rubyonrails rails 4.0.2

Vendor Advisories

Debian Bug report logs - #790486 rails: CVE-2015-3226: XSS in ActiveSupport::JSONencode Package: src:rails; Maintainer for src:rails is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 29 Jun 2015 18:36:01 UTC Sever ...
Debian Bug report logs - #790487 rails: CVE-2015-3227: Possible Denial of Service attack in Active Support Package: src:rails; Maintainer for src:rails is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 29 Jun 2015 1 ...
Multiple security issues have been discovered in the Ruby on Rails web application development framework, which may result in denial of service, cross-site scripting, information disclosure or bypass of input validation For the stable distribution (jessie), these problems have been fixed in version 2:418-1+deb8u1 For the unstable distribution ( ...
A flaw was found in the Action Pack component's caching of controller references An attacker could use this flaw to cause unbounded memory growth, potentially resulting in a denial of service ...