CRITICAL🇬🇧 English

CVE-2019-16676

CVSS 9.8v3.1pub. 2019-09-30upd. 2024-11-21

Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Plataformatec Simple Form

    APP
    Plataformatec
    < 5.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2019-5421CRITICAL9.8ten sam vendor

Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in ...

CVE-2019-16109MEDIUM5.3ten sam vendor

An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request wi...

CVE-2013-0233MEDIUM6.8ten sam vendor

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when u...