Ruby on Rails: Mehrere Schwachstellen
WID-SEC-2025-1085 · first 26.01.2016 · updated 18.03.2026 · CVSS 9,1
What it is about
Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um Sicherheitsfunktionen zu umgehen, um Dateien zu manipulieren oder um einen Denial of Service Zustand herbeizuführen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- Sicherheitsfunktionen zu umgehen
- Dateien zu manipulieren oder um einen Denial of Service Zustand herbeizuführen
Am I affected?
Affected according to the BSI:
- Red Hat Enterprise Linux 6
- Debian Linux
- SUSE Linux
- SUSE Linux Enterprise Server
- Red Hat Enterprise Linux 7
- Open Source Ruby on Rails <4.2.5.1
- Open Source Ruby on Rails <4.1.14.1
- Open Source Ruby on Rails <3.2.22.1
- SUSE openSUSE
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Ruby on Rails 4.2.5.1
- Open Source Ruby on Rails 4.1.14.1
- Open Source Ruby on Rails 3.2.22.1
Is the vulnerability already being exploited?
- CVE-2016-0752: exploited in the wild according to CISA, in the catalogue since 25.03.2022.
Information and sources
- Original BSI advisory (WID)
- Weblog Rubyonrails vom 2016-01-25 weblog.rubyonrails.org
- Debian Security Advisory DSA-3464 vom 2016-02-01 www.debian.org
- SUSE Security Update SUSE-SU-2016:0391-1 vom 2016-02-09 www.suse.com
- SUSE Security Update SUSE-SU-2016:0432-1 vom 2016-02-12 www.suse.com
- SUSE Security Update SUSE-SU-2016:0435-1 vom 2016-02-12 www.suse.com
- SUSE Security Update SUSE-SU-2016:0457-1 vom 2016-02-15 www.suse.com
- SUSE Security Update SUSE-SU-2016:0458-1 vom 2016-02-15 www.suse.com
- SUSE Security Update SUSE-SU-2016:0456-1 vom 2016-02-15 www.suse.com
- Red Hat Security Advisory RHSA-2016:0296 vom 2016-02-25 rhn.redhat.com
- SUSE Security Update SUSE-SU-2016:0600-1 vom 2016-02-26 www.suse.com
- SUSE Security Update SUSE-SU-2016:0598-1 vom 2016-02-26 www.suse.com
- SUSE Security Update SUSE-SU-2016:0597-1 vom 2016-02-26 www.suse.com
- SUSE Security Update SUSE-SU-2016:0599-1 vom 2016-02-26 www.suse.com
- SUSE Security Update SUSE-SU-2016:0619-1 vom 2016-03-01 www.suse.com
- SUSE Security Update SUSE-SU-2016:0623-1 vom 2016-03-01 www.suse.com
- SUSE Security Update SUSE-SU-2016:0618-1 vom 2016-03-01 www.suse.com
- Debian Security Advisory DSA-3509 vom 2016-03-09 www.debian.org
- Red Hat Security Advisory RHSA-2016:0454 vom 2016-03-16 rhn.redhat.com
- SUSE Security Update SUSE-SU-2016:0857-1 vom 2016-03-23 www.suse.com
- SUSE Security Update SUSE-SU-2016:0858-1 vom 2016-03-23 www.suse.com
- SUSE Security Update SUSE-SU-2016:0968-1 vom 2016-04-07 www.suse.com
- SUSE Security Update SUSE-SU-2016:1146-1 vom 2016-04-25 lists.opensuse.org
- CXSecurity #WLB-2016100137 vom 2016-10-23 cxsecurity.com
- SUSE Security Update SUSE-SU-2017:0475-1 vom 2017-02-16 www.suse.com
- openSUSE Security Update OPENSUSE-SU-2025:15125-1 vom 2025-05-18 lists.opensuse.org
and 1 more sources in the original advisory
CVE: CVE-2015-7576, CVE-2015-7577, CVE-2015-7578, CVE-2015-7579, CVE-2015-7580, CVE-2015-7581, CVE-2016-0751, CVE-2016-0752, CVE-2016-0753
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.