Skip to content
OpenAdvisories
Critical · 9.8 CVE-2018-3777 EUVD-2018-0368GHSA-534w-937m-v7x3

restforce vulnerable to Improper Input Validation

Published Aug 3, 2018 · Updated Sep 17, 2024 · Assigned by hackerone

Vendor: https://github.com/restforce Product: restforce ruby gem Package: restforce Ecosystem: RubyGems

Description

Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests.

Affected products

VendorProductAffectedFixed
https://github.com/restforce restforce ruby gem 3.0.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems restforce < 3.0.0 3.0.0 GHSA-534w-937m-v7x3

References