Every CVE Search/ Get API key

CVE-2016-0753

activemodel contains Improper Input Validation

5.3 MediumFix available

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

7.16%Up 3.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.3

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

Record
CVE-2016-0753
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Updated
2026-11-02
CVE List No score

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

Record
CVE-2016-0753
Updated
2026-11-02
EUVDEUVD-2017-0165 No score

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

Record
EUVD-2017-0165
Updated
2026-11-03
GitHub AdvisoriesGHSA-543v-gj2c-r3ch 5.3

activemodel contains Improper Input Validation

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

Record
GHSA-543v-gj2c-r3ch
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
OSV 5.3

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

Record
CVE-2016-0753
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2016-0753 5.3

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

Record
DEBIAN-CVE-2016-0753
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 9 moreShow less
OSVGHSA-543v-gj2c-r3ch 5.3

activemodel contains Improper Input Validation

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

Record
GHSA-543v-gj2c-r3ch
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-20
Updated
2026-11-02
OSVUBUNTU-CVE-2016-0753 5.3

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

Record
UBUNTU-CVE-2016-0753
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVSUSE-SU-2016:0432-1 No score

Security update for rubygem-activemodel-4_2

This update for rubygem-activemodel-4_2 fixes the following issues:

  • CVE-2016-0753: Input Validation Circumvention (bsc#963334)
Record
SUSE-SU-2016:0432-1
Updated
2026-11-02
OSVSUSE-SU-2016:0435-1 No score

Security update for rubygem-activesupport-4_2

This update for rubygem-activesupport-4_2 fixes the following issues:

  • CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)
  • CVE-2016-0753: Input Validation Circumvention (bsc#963334)
Record
SUSE-SU-2016:0435-1
Updated
2026-11-02
OSVSUSE-SU-2016:0458-1 No score

Security update for rubygem-activerecord-4_2

This update for rubygem-activerecord-4_2 fixes the following issues:

  • CVE-2016-0753: Input Validation Circumvention (bsc#963334)
  • CVE-2015-7577: Nested attributes rejection proc bypass (bsc#963330)
Record
SUSE-SU-2016:0458-1
Updated
2026-11-02
OSVSUSE-SU-2016:0597-1 No score

Security update for rubygem-activemodel-4_1

This update for rubygem-activemodel-4_1 fixes the following issues:

  • CVE-2016-0753: Input Validation Circumvention (bsc#963334)
Record
SUSE-SU-2016:0597-1
Updated
2026-11-02
OSVSUSE-SU-2016:0598-1 No score

Security update for rubygem-activerecord-4_1

This update for rubygem-activerecord-4_1 fixes the following issues:

  • CVE-2016-0753: Input Validation Circumvention (bsc#963334)
  • CVE-2015-7577: Nested attributes rejection proc bypass (bsc#963330)
Record
SUSE-SU-2016:0598-1
Updated
2026-11-02
OSVSUSE-SU-2016:0600-1 No score

Security update for rubygem-activesupport-4_1

This update for rubygem-activesupport-4_1 fixes the following issues:

  • CVE-2016-0753: Input Validation Circumvention (bsc#963334)
  • CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)
Record
SUSE-SU-2016:0600-1
Updated
2026-11-02
OSVSUSE-SU-2016:1146-1 No score

Security update for portus

Portus was updated to version 2.0.3, which brings several fixes and enhancements:

  • Fixed crono job when a repository could not be found.
  • Fixed compatibility issues with Docker 1.10 and Distribution 2.3.
  • Handle multiple scopes in token requests.
  • Add optional fields to token response.
  • Fixed notification events for Distribution v2.3.
  • Paginate through the catalog properly.
  • Do not remove all the repositories if fetching one fails.
  • Fixed SMTP setup.
  • Don't let crono overflow the 'log' column on the DB.
  • Show the actual LDAP error on invalid login.
  • Fixed the location of crono logs.
  • Always use relative paths.
  • Set RUBYLIB when using portusctl.
  • Don't count hidden teams on the admin panel.
  • Warn developers on unsupported docker-compose versions.
  • Directly invalidate LDAP logins without name and password.
  • Don't show the 'I forgot my password' link on LDAP.

The following Rubygems bundled within Portus have been updated to fix security issues:

  • CVE-2016-2098: rubygem-actionpack (bsc#969943).
  • CVE-2015-7578: rails-html-sanitizer (bsc#963326).
  • CVE-2015-7579: rails-html-sanitizer (bsc#963327).
  • CVE-2015-7580: rails-html-sanitizer (bsc#963328).
  • CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563).
  • CVE-2015-7577: rubygem-activerecord (bsc#963604).
  • CVE-2016-0751: rugygem-actionpack (bsc#963627).
  • CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608).
  • CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617).
  • CVE-2015-7581: rubygem-actionpack (bsc#963625).
Record
SUSE-SU-2016:1146-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
activemodel
RubyGems
 4.1.0 to 4.1.14.0
4.1.14.1
activemodel
RubyGems
 4.2.0 to 4.2.5.0
4.2.5.1
rails
Debian:12
 before 2:4.2.5.1-1
2:4.2.5.1-1
rails
Debian:13
 before 2:4.2.5.1-1
2:4.2.5.1-1
rails
Debian:14
 before 2:4.2.5.1-1
2:4.2.5.1-1
ruby-activemodel-3.2
Debian:7
 before 3.2.6-3+deb7u1, plus listed versions
3.2.6-3
3.2.6-3+deb7u1
ruby-activesupport-3.2
Debian:7
 before 3.2.6-6+deb7u3, plus listed versions
3.2.6-63.2.6-6+deb7u13.2.6-6+deb7u2
3.2.6-6+deb7u3
ruby-activerecord-3.2
Debian:7
 before 3.2.6-5+deb7u3, plus listed versions
3.2.6-53.2.6-5+deb7u13.2.6-5+deb7u2
3.2.6-5+deb7u3
rails
Debian:8
 before 2:4.1.8-1+deb8u1, plus listed versions
2:4.1.8-1
2:4.1.8-1+deb8u1
activemodel
RubyGems
 4.1.0 up to 4.1.14.1, plus listed versions
4.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc3
Show 24 moreShow less
4.1.10.rc44.1.114.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.rc14.1.14.rc24.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc1
4.1.14.1
Show 26 moreShow less
Affected packages
PackageAffectedFixed
activemodel
RubyGems
 4.2.0 up to 4.2.5.1, plus listed versions
4.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc4
Show 8 moreShow less
4.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.rc14.2.5.rc2
4.2.5.1
rh-ror41-rubygem-actionpack
Red Hat:rhel_software_collections:2::el6
 before 1:4.1.5-3.el6
1:4.1.5-3.el6
rh-ror41-rubygem-actionpack-doc
Red Hat:rhel_software_collections:2::el6
 before 1:4.1.5-3.el6
1:4.1.5-3.el6
rh-ror41-rubygem-actionview
Red Hat:rhel_software_collections:2::el6
 before 0:4.1.5-4.el6
0:4.1.5-4.el6
rh-ror41-rubygem-actionview-doc
Red Hat:rhel_software_collections:2::el6
 before 0:4.1.5-4.el6
0:4.1.5-4.el6
rh-ror41-rubygem-activemodel
Red Hat:rhel_software_collections:2::el6
 before 0:4.1.5-2.el6
0:4.1.5-2.el6
rh-ror41-rubygem-activemodel-doc
Red Hat:rhel_software_collections:2::el6
 before 0:4.1.5-2.el6
0:4.1.5-2.el6
rh-ror41-rubygem-activerecord
Red Hat:rhel_software_collections:2::el6
 before 1:4.1.5-2.el6
1:4.1.5-2.el6
rh-ror41-rubygem-activerecord-doc
Red Hat:rhel_software_collections:2::el6
 before 1:4.1.5-2.el6
1:4.1.5-2.el6
rh-ror41-rubygem-activesupport
Red Hat:rhel_software_collections:2::el6
 before 1:4.1.5-3.el6
1:4.1.5-3.el6
rh-ror41-rubygem-actionpack
Red Hat:rhel_software_collections:2::el7
 before 1:4.1.5-3.el7
1:4.1.5-3.el7
rh-ror41-rubygem-actionpack-doc
Red Hat:rhel_software_collections:2::el7
 before 1:4.1.5-3.el7
1:4.1.5-3.el7
rh-ror41-rubygem-actionview
Red Hat:rhel_software_collections:2::el7
 before 0:4.1.5-4.el7
0:4.1.5-4.el7
rh-ror41-rubygem-actionview-doc
Red Hat:rhel_software_collections:2::el7
 before 0:4.1.5-4.el7
0:4.1.5-4.el7
rh-ror41-rubygem-activemodel
Red Hat:rhel_software_collections:2::el7
 before 0:4.1.5-2.el7
0:4.1.5-2.el7
rh-ror41-rubygem-activemodel-doc
Red Hat:rhel_software_collections:2::el7
 before 0:4.1.5-2.el7
0:4.1.5-2.el7
rh-ror41-rubygem-activerecord
Red Hat:rhel_software_collections:2::el7
 before 1:4.1.5-2.el7
1:4.1.5-2.el7
rh-ror41-rubygem-activerecord-doc
Red Hat:rhel_software_collections:2::el7
 before 1:4.1.5-2.el7
1:4.1.5-2.el7
rh-ror41-rubygem-activesupport
Red Hat:rhel_software_collections:2::el7
 before 1:4.1.5-3.el7
1:4.1.5-3.el7
rubygem-activemodel-4_2
SUSE:Enterprise Storage 2.1
 before 4.2.2-5.1
4.2.2-5.1
rubygem-activesupport-4_2
SUSE:Enterprise Storage 2.1
 before 4.2.2-6.1
4.2.2-6.1
rubygem-activerecord-4_2
SUSE:Enterprise Storage 2.1
 before 4.2.2-5.1
4.2.2-5.1
rubygem-activemodel-4_1
SUSE:OpenStack Cloud 5
 before 4.1.9-9.1
4.1.9-9.1
rubygem-activerecord-4_1
SUSE:OpenStack Cloud 5
 before 4.1.9-9.1
4.1.9-9.1
rubygem-activesupport-4_1
SUSE:OpenStack Cloud 5
 before 4.1.9-12.1
4.1.9-12.1
portus
SUSE:Linux Enterprise Module for Containers 12
 before 2.0.3-2.4
2.0.3-2.4

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-0753 is a medium vulnerability (CVSS 5.3) in Rubyonrails Rails, published January 31, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.16%, the 94th percentile. Fixed in activemodel 4.1.14.1.

References

Show 77 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open