# CVE-2016-2098

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

- Page: https://www.vulneraibility.com/cve/CVE-2016-2098
- CVSS: 7.3
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 81.45% (percentile 99.6)
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module · 12 GitHub proofs of concept (first 2016-03-01)
- Published: 2016-04-07

## Affected

- debian:debian_linux
- rubyonrails:rails
- rubyonrails:ruby_on_rails

## References

- [advisory] http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
- [advisory] http://www.debian.org/security/2016/dsa-3509
- [other] http://www.securityfocus.com/bid/83725
- [other] http://www.securitytracker.com/id/1035122
- [exploit] https://www.exploit-db.com/exploits/40086/
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
- [other] https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ
- [other] http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.