ADVISORIES

• CVE-2015-4410 (NVD)
• GHSA-f93j-hmcr-jcwh
• Vendor Advisory

GEM

moped

SEVERITY

CVSS v3.x: 7.5 (High)

PATCHED VERSIONS

• ~> 1.5.3
• >= 2.0.5

DESCRIPTION

A flaw in the ObjectId validation regular expression can enable attackers to inject arbitrary information into a given BSON object.

RELATED

• https://github.com/mongoid/moped/compare/e5fc928bcb5b7b89d171e31e31483be4185971b9...32cba17ad7d3da326778b4d8cd4b52e75bca9d40
• https://github.com/mongoid/moped/commit/276fbfd23c5ffb65e6bd18d564c8b6878c2498ac