What is the CVSS score of CVE-2015-3224?

CVE-2015-3224 has a CVSS 2.0 base score of 4.3 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. EPSS exploitation probability: 85.3%.

Is there a public PoC exploit available for CVE-2015-3224?

Yes, a public proof-of-concept exploit is available for CVE-2015-3224. Prioritise patching immediately. EPSS: 85.3%.

Is there a patch available for CVE-2015-3224?

Yes, a patch is available for CVE-2015-3224. Update the affected software to the latest version immediately.

Web Console CVE-2015-3224

MEDIUM

Improper Access Control (CWE-284)

2015-07-26 secalert@redhat.com

Authentication Bypass Web Console Rubyonrails

4.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Confidentiality

None

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Jul 26, 2015 - 22:59 cve.org

MEDIUM 4.3

DescriptionCVE.org

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.

AnalysisAI

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 85.3%.

Technical ContextAI

This vulnerability is classified under CWE-284. request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request. Affected products include: Rubyonrails Web Console. Version information: before 2.1.3.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.