GCVE - cpe:2.3:a:rails_admin_project:rails

Approved changes feed: RSS · Atom

cpe:2.3:a:rails_admin_project:rails_admin:*:*:*:*:*:ruby:*:*

part: a version: * update: *

Vendor	Rails Admin Project (`0e948536-74dc-5828-bc1a-01b4b6a5a59a`)
Product	Rails Admin (`71d6dc45-27a3-515e-b043-332179436304`)
Edition	*
Language	*
Software edition	*
Target software	ruby
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:gem/rails_admin`	purl2cpe	2026-06-01 10:12:59.508584
`pkg:github/railsadminteam/rails_admin`	purl2cpe	2026-06-01 10:12:59.508586

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-39308`	vulnerable	2026-06-08 06:41:49.036477	RailsAdmin Cross-site Scripting vulnerability in the list view MEDIUM (6.8) RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. Upgrade to 3.1.3 or 2.2.2 (to be released). Published: 2024-07-08T14:33:55.144Z Updated: 2024-08-02T04:19:20.581Z Open on db.gcve.eu Reference links https://github.com/railsadminteam/rails_admin/security/advisories/GHSA-8qgm-g2vv-vwvc https://github.com/railsadminteam/rails_admin/issues/3686 https://github.com/railsadminteam/rails_admin/commit/b5a287d82e2cbd1737a1a01e11ede2911cce7fef https://github.com/railsadminteam/rails_admin/commit/d84b39884059c4ed50197cec8522cca029a17673 https://rubygems.org/gems/rails_admin/versions/2.3.0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-36190`	vulnerable	2026-06-08 05:25:02.705653	Details available RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms. Published: 2021-01-12T19:38:20.000Z Updated: 2024-08-04T17:23:09.572Z Open on db.gcve.eu Reference links https://github.com/sferik/rails_admin/blob/master/README.md https://github.com/sferik/rails_admin/commit/d72090ec6a07c3b9b7b48ab50f3d405f91ff4375 https://github.com/sferik/rails_admin/compare/v1.4.2...v1.4.3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10522`	vulnerable	2026-06-08 05:07:25.255238	Details available rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem. Published: 2018-07-05T16:00:00.000Z Updated: 2024-08-06T03:21:52.174Z Open on db.gcve.eu Reference links https://www.sourceclear.com/blog/Rails_admin-Vulnerability-Disclosure/ https://github.com/sferik/rails_admin/commit/b13e879eb93b661204e9fb5e55f7afa4f397537a https://www.sourceclear.com/registry/security/cross-site-request-forgery-csrf-/ruby/sid-3173	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Rails Admin

Notes

PURL mappings

Vulnerability references

Contribute