CVE-2015-3224: rubyonrails web_console Improper Access Control
Vulnerability summary
CVE-2015-3224 is a medium (CVSS 4.3) Improper Access Control vulnerability in rubyonrails web_console. EPSS estimates a 44.71% chance of exploitation in the next 30 days, higher than 98.7% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 26-07-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
44.71%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 44.71% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundRuby on Rails 4.0.x/4.1.x/4.2.x (Web Console v2) - Whitelist Bypass Code Execution (Metasploit)
Maturity: weaponized
Ruby on Rails Web Console (v2) Whitelist Bypass Code Execution
exploit/multi/http/rails_web_console_v2_code_exec
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Opensuse2 products
- ruby3.2-rubygem-web-console&distro=openSUSE Tumbleweed< 4.2.0-1.9
- rubygem-web-console&distro=openSUSE Tumbleweed< 4.2.1-1.5 | < 4.2.1-1.7 | < 4.2.1-1.9
RubyGems1 product
- web-console< 2.1.3
Rubyonrails1 product
- web_console≤ 2.1.2
3 vendors · 4 products
References
11 links- groups.google.com/forum/message/raw?msg=rubyonrails-security/lzmz9_ijUFw/HBMPi4zp5NAJMailing ListX Refsource MLISTVendor Advisory
- lists.fedoraproject.org/pipermail/package-announce/2015-June/160881.htmlVendor AdvisoryX Refsource FEDORAWEB
- lists.opensuse.org/archives/…Advisory
- github.com/rails/web-consolePACKAGE