cve.bz

CVE-2012-3424

no score yetEPSS 1.9%

rubyonrails: no CVSS score yet. EPSS 1.9% chance of exploitation in the next 30 days. Fixed in actionpack 2.3.5, 3.0.16, 3.1.7.

The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method.
EPSS
1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE
CWE-287
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-92w9-2pqw-rhjjRubyGemsactionpack>=3.0.0.beta <3.0.163.0.16
GHSA-92w9-2pqw-rhjjRubyGemsactionpack>=3.1.0 <3.1.73.1.7
GHSA-92w9-2pqw-rhjjRubyGemsactionpack>=3.2.0 <3.2.73.2.7
GHSA-92w9-2pqw-rhjjRubyGemsactionpack<2.3.52.3.5

References

Check your stackJSON