{"id":"CVE-2016-2098","published":"2016-04-07T23:00:00Z","modified":"2024-08-05T23:17:50Z","title":"Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw lies in Action Pack, the component of Ruby on Rails, in versions before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2. An attacker with remote access can execute arbitrary Ruby code by abusing an application's unrestricted use of the render method, which requires that the affected application pass untrusted input into render.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:19:25Z"},"cvss":null,"epss":{"score":0.81445,"percentile":0.99638,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.debian.org/security/2016/dsa-3509","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.securityfocus.com/bid/83725","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securitytracker.com/id/1035122","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://www.exploit-db.com/exploits/40086/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=3.0.0, <3.2.22.2",">=4.0.0, <4.1.14.2",">=4.2.0, <4.2.5.2"],"patched":["3.2.22.2","4.1.14.2","4.2.5.2"],"from":["GHSA-78rc-8c29-p45g"],"provenance":"source"}],"advisories":[{"id":"GHSA-78rc-8c29-p45g","url":"https://github.com/advisories/GHSA-78rc-8c29-p45g","severity":"HIGH","ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=3.0.0, <3.2.22.2"],"patched":["3.2.22.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-78rc-8c29-p45g","url":"https://github.com/advisories/GHSA-78rc-8c29-p45g","severity":"HIGH","ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=4.0.0, <4.1.14.2"],"patched":["4.1.14.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-78rc-8c29-p45g","url":"https://github.com/advisories/GHSA-78rc-8c29-p45g","severity":"HIGH","ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=4.2.0, <4.2.5.2"],"patched":["4.2.5.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2017-0185","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-0185","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":40086,"url":"https://www.exploit-db.com/exploits/40086","title":"Ruby on Rails ActionPack Inline ERB - Code Execution (Metasploit)","type":"remote","platform":"ruby","date":"2016-07-11","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2016-07-11"},"pocGithub":{"count":11,"skipped":1,"earliest":"2016-03-01","earliestUrl":"https://github.com/hderms/dh-CVE_2016_2098","repos":[{"name":"0x00-0x00/CVE-2016-2098","url":"https://github.com/0x00-0x00/CVE-2016-2098","stars":16,"created":"2018-02-09"},{"name":"j4k0m/CVE-2016-2098","url":"https://github.com/j4k0m/CVE-2016-2098","stars":4,"created":"2021-08-31"},{"name":"hderms/dh-CVE_2016_2098","url":"https://github.com/hderms/dh-CVE_2016_2098","stars":3,"created":"2016-03-01"},{"name":"DanielHemmati/CVE-2016-2098-my-first-exploit","url":"https://github.com/DanielHemmati/CVE-2016-2098-my-first-exploit","stars":2,"created":"2020-07-27"},{"name":"Shakun8/CVE-2016-2098","url":"https://github.com/Shakun8/CVE-2016-2098","stars":2,"created":"2022-09-24"}]},"metasploit":[{"name":"Ruby on Rails ActionPack Inline ERB Code Execution","module":"exploit/multi/http/rails_actionpack_inline_exec","type":"exploit","disclosureDate":"2016-03-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_actionpack_inline_exec.rb"}],"first":{"date":"2016-03-01","source":"PoC-in-GitHub","url":"https://github.com/hderms/dh-CVE_2016_2098"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/40086/","https://www.exploit-db.com/exploits/40086"],"flow":[],"timeline":[{"date":"2016-03-01","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2016-03-01, Exploit-DB 2016-07-11","url":"https://github.com/hderms/dh-CVE_2016_2098","provenance":"source"},{"date":"2016-04-07","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2016-2098","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9964"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 advisory exploit reference; 11 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2015-7576","published":"2016-02-16","fixed":"4.1.14.1","kev":false,"link":{"from":"CVE-2015-7576","to":"CVE-2016-2098","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"3.2.22.1","toFixed":"3.2.22.2","daysApart":51},{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"4.1.14.1","toFixed":"4.1.14.2","daysApart":51}]}},{"cve":"CVE-2015-7581","published":"2016-02-16","fixed":"4.2.5.1","kev":false,"link":{"from":"CVE-2015-7581","to":"CVE-2016-2098","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"4.2.5.1","toFixed":"4.2.5.2","daysApart":51}]}},{"cve":"CVE-2016-0751","published":"2016-02-16","fixed":"4.2.5.1","kev":false},{"cve":"CVE-2016-0752","published":"2016-02-16","fixed":"4.2.5.1","kev":true},{"cve":"CVE-2016-2098","published":"2016-04-07","fixed":"4.2.5.2","kev":false},{"cve":"CVE-2020-8164","published":"2020-06-19","fixed":"6.0.3.1","kev":false},{"cve":"CVE-2020-8166","published":"2020-07-02","fixed":"6.0.3.1","kev":false},{"cve":"CVE-2020-8185","published":"2020-07-02","fixed":"6.0.3.2","kev":false}],"package":"RubyGems:actionpack"}}