Every CVE Search/ Get API key

CVE-2011-3187

actionpack Improper Input Validation vulnerability

4.3 MediumPublic exploitFix available

CVE-2011-3187 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published August 29, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.67%, the 93rd percentile. Fixed in actionpack 2.3.13.

The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

Exploit likelihood

6.67%Down 4.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

Record
CVE-2011-3187
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

Record
CVE-2011-3187
Updated
2026-11-02
EUVDEUVD-2017-0159 No score

The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

Record
EUVD-2017-0159
Updated
2026-11-03
GitHub AdvisoriesGHSA-3vfw-7rcp-3xgm No score

actionpack Improper Input Validation vulnerability

The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

Record
GHSA-3vfw-7rcp-3xgm
Weakness
CWE-20
Updated
2026-11-02
OSV No score

The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

Record
CVE-2011-3187
Updated
2026-11-02
OSVDEBIAN-CVE-2011-3187 No score

The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

Record
DEBIAN-CVE-2011-3187
Updated
2026-11-02
OSVGHSA-3vfw-7rcp-3xgm No score

actionpack Improper Input Validation vulnerability

The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

Record
GHSA-3vfw-7rcp-3xgm
Weakness
CWE-20
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
actionpack
RubyGems
 2.3.0 up to 2.3.13
2.3.13
rails
Debian:12
 All versions, plus listed versions
2:6.1.7.10+dfsg-1~deb12u12:6.1.7.10+dfsg-1~deb12u22:6.1.7.10+dfsg-1~deb12u32:6.1.7.3+dfsg-12:6.1.7.3+dfsg-10
Show 38 moreShow less
2:6.1.7.3+dfsg-112:6.1.7.3+dfsg-122:6.1.7.3+dfsg-132:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-92:7.2.2.1+dfsg-12:7.2.2.1+dfsg-1~exp12:7.2.2.1+dfsg-1~exp22:7.2.2.1+dfsg-1~exp32:7.2.2.1+dfsg-1~exp42:7.2.2.1+dfsg-1~exp62:7.2.2.1+dfsg-22:7.2.2.1+dfsg-32:7.2.2.1+dfsg-42:7.2.2.1+dfsg-52:7.2.2.1+dfsg-62:7.2.2.1+dfsg-72:7.2.2.2+dfsg-12:7.2.2.2+dfsg-22:7.2.2.2+dfsg-2~deb13u12:7.2.2.2+dfsg-2~deb13u22:7.2.3+dfsg-12:7.2.3+dfsg-22:7.2.3+dfsg-32:7.2.3.1+dfsg-12:7.2.3.2+dfsg-12:7.2.3.2+dfsg-22:7.2.3.2+dfsg-32:7.2.4+dfsg-12:7.2.4+dfsg-2
 None known
rails
Debian:13
 All versions, plus listed versions
2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-12:7.2.2.2+dfsg-22:7.2.2.2+dfsg-2~deb13u12:7.2.2.2+dfsg-2~deb13u2
Show 9 moreShow less
2:7.2.3+dfsg-12:7.2.3+dfsg-22:7.2.3+dfsg-32:7.2.3.1+dfsg-12:7.2.3.2+dfsg-12:7.2.3.2+dfsg-22:7.2.3.2+dfsg-32:7.2.4+dfsg-12:7.2.4+dfsg-2
 None known
rails
Debian:14
 All versions, plus listed versions
2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-12:7.2.2.2+dfsg-22:7.2.2.2+dfsg-2~deb13u12:7.2.2.2+dfsg-2~deb13u2
Show 9 moreShow less
2:7.2.3+dfsg-12:7.2.3+dfsg-22:7.2.3+dfsg-32:7.2.3.1+dfsg-12:7.2.3.2+dfsg-12:7.2.3.2+dfsg-22:7.2.3.2+dfsg-32:7.2.4+dfsg-12:7.2.4+dfsg-2
 None known
actionpack
RubyGems
 2.3.0 up to 2.3.13, plus listed versions
2.3.102.3.112.3.122.3.22.3.3
Show 8 moreShow less
2.3.42.3.52.3.62.3.72.3.82.3.8.pre12.3.92.3.9.pre
2.3.13

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBRuby on Rails 3.0.5 - 'WEBrick::HTTPRequest' Module HTTP Header Injection2011-02-16

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open