{"id":"CVE-2008-7309","aliases":["EUVD-2008-7262","GHSA-px8j-39w4-633h"],"status":"published","title":"Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a...","description":"Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the ForumPost user_id value via a modified URL, related to a \"mass assignment\" vulnerability.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01053,"percentile":0.64592,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-255"],"published":"2012-04-04T22:00:00Z","modified":"2026-06-16T23:04:01Z","products":[{"vendor":"insoshi","product":"insoshi"}],"references":[{"url":"http://railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://blog.mhartl.com/2008/09/21/finding-and-fixing-mass-assignment-problems-in-rails-applications/","tags":["x_refsource_CONFIRM","x_transferred","Exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-7309"},{"url":"http://blog.mhartl.com/2008/09/21/finding-and-fixing-mass-assignment-problems-in-rails-applications"},{"url":"https://github.com/advisories/GHSA-px8j-39w4-633h"}],"sources":{"cve":[{"id":"CVE-2008-7309","description":"Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the ForumPost user_id value via a modified URL, related to a \"mass assignment\" vulnerability.","status":"published","published":"2012-04-04T22:00:00Z","modified":"2024-09-16T19:05:17.481Z","updated_at":"2026-11-02T14:34:48.505097Z"}],"euvd":[{"id":"EUVD-2008-7262","description":"Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the ForumPost user_id value via a modified URL, related to a \"mass assignment\" vulnerability.","status":"published","published":"2012-04-04T22:00:00Z","modified":"2024-09-16T19:05:17Z","updated_at":"2026-11-03T00:55:26.31684Z"}],"ghsa":[{"id":"GHSA-px8j-39w4-633h","title":"Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a...","description":"Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the ForumPost user_id value via a modified URL, related to a \"mass assignment\" vulnerability.","status":"published","published":"2022-05-17T05:30:58Z","modified":"2025-04-11T03:56:40Z","updated_at":"2026-11-02T15:01:10.591916Z"}],"nvd":[{"id":"CVE-2008-7309","description":"Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the ForumPost user_id value via a modified URL, related to a \"mass assignment\" vulnerability.","status":"published","published":"2012-04-05T13:25:20.913Z","modified":"2026-06-16T23:04:01.88Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-255"],"updated_at":"2026-11-02T14:01:32.353533Z"}]}}