VULNERABILITY INTELLIGENCE
CVE-2010-3933
CVSS score6.4 MEDIUM
EPSS probability2.21%
CISA KEVNot currently listed
Published2010-10-28
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:N/I:P/A:P
Description
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
Weakness classification
- CWE-20: Improper Input Validation
Primary references
- cve@mitre.org — Vendor Advisory
- cve@mitre.org
- cve@mitre.org — Vendor Advisory
- cve@mitre.org — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory