CVE-2008-5189
rails is vulnerable to CRLF injection
EPSS 0.34%
Description
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
How to fix CVE-2008-5189
To remediate CVE-2008-5189, upgrade the affected package to a fixed version below.
- Debian/rails—upgrade to 2.1.0-6 or later
- RubyGems/rails—upgrade to 2.0.5 or later
Is CVE-2008-5189 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 2.1.0-6
- from 0, < 2.0.5