{"action":"Upgrade actionpack to 3.2.22.2 or later.","affected":[{"fixed":"3.2.22.2","introduced":"3.0.0"},{"fixed":"4.1.14.2","introduced":"4.0.0"},{"fixed":"4.2.5.2","introduced":"4.2.0"}],"component":"actionpack","cve_ids":["CVE-2016-2098"],"ecosystem":"RubyGems","epss":0.81445,"exploited":false,"fixed_versions":["3.2.22.2","4.1.14.2","4.2.5.2"],"ghsa_id":"GHSA-78rc-8c29-p45g","id":"tcs_01M5KEHMQC89CK718TPPNRB4AB","modified_at":"2024-02-20T05:23:27.150669Z","published_at":"2017-10-24T18:33:35Z","references":["https://osv.dev/vulnerability/GHSA-78rc-8c29-p45g","https://nvd.nist.gov/vuln/detail/CVE-2016-2098","https://github.com/rails/rails","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-2098.yml","https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q","https://web.archive.org/web/20200228015318/http://www.securityfocus.com/bid/83725","https://web.archive.org/web/20210612214217/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ","https://web.archive.org/web/20211205173437/https://securitytracker.com/id/1035122","https://www.exploit-db.com/exploits/40086","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html","http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html","http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html","http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html","http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released","http://www.debian.org/security/2016/dsa-3509"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-78rc-8c29-p45g","url":"https://osv.dev/vulnerability/GHSA-78rc-8c29-p45g"}],"summary":"actionpack allows remote code execution via application's unrestricted use of render method"}