CVE-2006-4111
Ruby on Rails vulnerable to code injection
EPSS 4.0%
Description
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
How to fix CVE-2006-4111
To remediate CVE-2006-4111, upgrade the affected package to a fixed version below.
- Debian/rails—upgrade to 1.1.5-1 or later
- RubyGems/rails—upgrade to 1.1.6 or later
Is CVE-2006-4111 being exploited?
Low — EPSS is 4.0%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 1.1.5-1
- >= 1.1.0, < 1.1.6