CVE-2008-7248: rubyonrails rails Improper Input Validation
Vulnerability summary
CVE-2008-7248 is a medium (CVSS 6.8) Improper Input Validation vulnerability in rubyonrails rails. EPSS estimates a 8.08% chance of exploitation in the next 30 days, higher than 94.7% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 16-12-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
8.08%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 8.08% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (rorsecurity.info)
Maturity: unknown
Ruby on Rails 2.3.5 - 'protect_from_forgery' Cross-Site Request Forgery
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Debian1 product
- rails< 2.2.3-1
RubyGems1 product
- actionpack≥ 2.1.0, < 2.1.3 | ≥ 2.2.0, < 2.2.2
Rubyonrails1 product
- rails2.1.0 | 2.1.1 | 2.1.2 | 2.2.0 | 2.2.1
3 vendors · 3 products
References
26 links- www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.htmlX Refsource MISCExploit
- pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/X Refsource MISC
- lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.htmlVendor AdvisoryX Refsource SUSEWEB
Show all 26 references
- github.com/rails/railsPACKAGE