Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-BCAB06E35B4C177D48A9C9F54B8EA9BBImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.133 Low
EPSS
Percentile
95.6%
The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| gem/activerecord | lt | 3.0.14 | |
| gem/activerecord | ge | 3.1.0 | |
| gem/activerecord | lt | 3.1.6 | |
| gem/activerecord | ge | 3.2.0 | |
| gem/activerecord | lt | 3.2.6 |
References
lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
rhn.redhat.com/errata/RHSA-2013-0154.html
github.com/advisories/GHSA-76wq-xw4h-f8wj
groups.google.com/group/rubyonrails-security/msg/aee3413fb038bf56?dmode=source&output=gplain
nvd.nist.gov/vuln/detail/CVE-2012-2695
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.133 Low
EPSS
Percentile
95.6%