-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the insecure use of permit! in the updated_ajax method, as shown in the pre-patch code diff. This method allowed mass assignment of any parameters under :password, including unauthorized attributes. The GitHub patch explicitly replaces permit! with a restricted permit(%i[password password_confirmation]) and adds parameter validation, confirming this was the vulnerable entry point. The CWE-915 mapping and advisory descriptions directly reference this insecure parameter handling pattern.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| camaleon_cms | rubygems | < 2.9.1 | 2.9.1 |
A Semantic Attack on Google Gemini - Read the Latest Research