CVE-2019-16676
Critical
Description
Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.
SeverityCritical
CVSS9.8
Exploit probability—
ProductPlataformatec Simple Form
PublishedSep 30, 2019
First seenSep 30, 2019
How to fix
Update
- plataformatec simple_form5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| plataformatec simple_form | v < 5.0 | 5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.