CVE-2016-2098

Severity: high (CVSS 7.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 81.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-04-07 · updated 2026-06-17
Weakness: CWE-20

Description

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Affected products

Debian Linux: 8.0
Ruby on Rails: 4.0.0, 4.0.0-beta, 4.0.0-rc1, 4.0.0-rc2, 4.0.1, 4.0.1-rc1 (+64)
rubyonrails Ruby On Rails: through 3.2.22.1; 4.1.14.1

References

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/
http://www.debian.org/security/2016/dsa-3509
http://www.securityfocus.com/bid/83725
http://www.securitytracker.com/id/1035122
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ
https://www.exploit-db.com/exploits/40086/

Get alerted when CVE-2016-2098 or the next vulnerability affects your stack