Nathaniel Bibler
Gregg Pollack
Security Vulnerability in Nested Attributes code in Ruby On Rails 2.3.9 and 3.0.0
Late last week, a vulnerability was identified in Rails which affects version 2.3.9 and 3.0.0. Specifically, it affects the ActiveRecord accepts_nested_attributes_for call. It allows an attacker to modify the form data transmitted back to your application in a way that may cause corruption or modification of other records in your database. The Rails Core team has released version 2.3.10 and 3.0.1 to fix the problem. You are encouraged to update as soon as is possible, now that this is a known threat.
