Every CVESearch/Get API key

CVE-2011-2929

actionpack Improper Input Validation vulnerability

5.0 MediumFix available

CVE-2011-2929 is a medium vulnerability (CVSS 5.0) in Rubyonrails Rails, published August 29, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.81%, the 79th percentile. Fixed in actionpack 3.0.10.

What does this mean?
Severity
5.0 MediumCVSS 2.0, NVD
Exploit chance
1.81%EPSS, 79th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
3.0.10actionpack +1 more

Description

The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."

Exploit likelihood

1.81%Down 0.4 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
actionpack
RubyGems
3.0.0 up to 3.0.10
3.0.10
actionpack
RubyGems
3.0.0 up to 3.0.10, plus listed versions
3.0.13.0.10.rc13.0.23.0.33.0.4
Show 18 moreShow less
3.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc5
3.0.10

What each source reports

NVD Score used5.0

The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."

Record
CVE-2011-2929
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE ListNo score

The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."

Record
CVE-2011-2929
Updated
2026-11-02
EUVDEUVD-2017-0297No score

The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."

Record
EUVD-2017-0297
Updated
2026-11-03
GitHub AdvisoriesGHSA-r7q2-5gqg-6c7qNo score

actionpack Improper Input Validation vulnerability

The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."

Record
GHSA-r7q2-5gqg-6c7q
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-r7q2-5gqg-6c7qNo score

actionpack Improper Input Validation vulnerability

The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."

Record
GHSA-r7q2-5gqg-6c7q
Weakness
CWE-20
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 11 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open