ActiveRecord vulnerable to modification of protected model attributes

2017-10-2418:33:37

Google

osv.dev

0.009 Low

EPSS

Percentile

83.0%

JSON

ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.

CPENameOperatorVersion
activerecordeq1.10.0
activerecordeq1.15.0
activerecordeq1.14.1
activerecordeq1.15.2
activerecordeq2.0.1
activerecordeq1.11.0
activerecordeq3.1.2.rc2
activerecordeq1.5.0
activerecordeq2.3.6
activerecordeq2.1.2

Name	Operator	Version
activerecord	eq	1.10.0
activerecord	eq	1.15.0
activerecord	eq	1.14.1
activerecord	eq	1.15.2
activerecord	eq	2.0.1
activerecord	eq	1.11.0
activerecord	eq	3.1.2.rc2
activerecord	eq	1.5.0
activerecord	eq	2.3.6
activerecord	eq	2.1.2