6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
0.004 Low
EPSS
Percentile
72.8%
Due to the way Active Record interprets parameters in combination with the way that JSON parameters are parsed, it is possible for an attacker to issue unexpected database queries with “IS NULL” or empty where clauses. This issue does not let an attacker insert arbitrary values into an SQL query, however they can cause the query to check for NULL or eliminate a WHERE clause when most users wouldn’t expect it.
CPE | Name | Operator | Version |
---|---|---|---|
gem/activerecord | lt | 3.0.19 | |
gem/activerecord | ge | 3.1.0 | |
gem/activerecord | lt | 3.1.10 | |
gem/activerecord | ge | 3.2.0 | |
gem/activerecord | lt | 3.2.11 |