Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPlataformatec Simple Form
APPPlataformatec< 5.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References
Related vulnerabilities
CVE-2019-5421CRITICAL9.8ten sam vendor
Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in ...
CVE-2019-16109MEDIUM5.3ten sam vendor
An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request wi...
CVE-2013-0233MEDIUM6.8ten sam vendor
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when u...