CVE-2011-3187
rubyonrails rails: no CVSS score yet. EPSS 6.7% chance of exploitation in the next 30 days. Fixed in actionpack 2.3.13.
The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
- EPSS
- 6.7% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rubyonrails:rails
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3vfw-7rcp-3xgm | RubyGems | actionpack | >=2.3.0 <2.3.13 | 2.3.13 |
References
- http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0337.html
- http://webservsec.blogspot.com/2011/02/ruby-on-rails-vulnerability.html
- http://www.openwall.com/lists/oss-security/2011/08/17/1
- http://www.openwall.com/lists/oss-security/2011/08/19/11
- http://www.openwall.com/lists/oss-security/2011/08/20/1