The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2011-08-29T18:00:00Z
Updated: 2024-08-06T23:22:27.754Z
Reserved: 2011-08-19T00:00:00Z
Link: CVE-2011-3187
Vulnrichment
No data.
NVD
Status : Modified
Published: 2011-08-29T18:55:01.707
Modified: 2024-11-21T01:29:56.067
Link: CVE-2011-3187
Redhat
No data.