Lucene search
PRIOn knowledge basePRION:CVE-2012-2661HistoryJun 22, 2012 - 2:55 p.m.
Sql injection
2012-06-2214:55:00
PRIOn knowledge base
www.prio-n.com
20
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
| CPE | Name | Operator | Version |
|---|---|---|---|
| rails | eq | 3.0.0 beta | |
| rails | eq | 3.0.0 beta2 | |
| rails | eq | 3.0.0 beta3 | |
| rails | eq | 3.0.0 beta4 | |
| rails | eq | 3.0.0 rc | |
| rails | eq | 3.0.0 rc2 | |
| rails | eq | 3.0.1 pre | |
| rails | eq | 3.0.2 pre | |
| rails | eq | 3.0.0 | |
| rails | eq | 3.0.10 rc1 |
References
lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
rhn.redhat.com/errata/RHSA-2013-0154.html
groups.google.com/group/rubyonrails-security/msg/fc2da6c627fc92df?dmode=source&output=gplain
Related
github
github
Active Record vulnerable to SQL Injection via nested query parameters
2017-10-24 18:33:38
activerecord vulnerable to SQL Injection
2017-10-24 18:33:38
cve
cve
CVE-2012-2661
2012-06-22 14:55:01
CVE-2012-2695
2012-06-22 14:55:01
debiancve
debiancve
CVE-2012-2661
2012-06-22 14:55:01
osv
osv
activerecord vulnerable to SQL Injection
2017-10-24 18:33:38
Active Record vulnerable to SQL Injection via nested query parameters
2017-10-24 18:33:38
openvas
openvas
Fedora Update for rubygem-activerecord FEDORA-2012-9639
2012-07-03 00:00:00
Fedora Update for rubygem-activerecord FEDORA-2012-9635
2012-08-30 00:00:00
Fedora Update for rubygem-activerecord FEDORA-2012-9639
2012-07-03 00:00:00
ubuntucve
ubuntucve
CVE-2012-2661
2012-06-22 00:00:00
CVE-2012-2695
2012-06-22 00:00:00
prion
prion
Sql injection
2012-06-22 14:55:00
fedora
fedora
[SECURITY] Fedora 16 Update: rubygem-activerecord-3.0.10-3.fc16
2012-06-30 08:25:19
[SECURITY] Fedora 17 Update: rubygem-activerecord-3.0.11-3.fc17
2012-06-30 08:27:28
[SECURITY] Fedora 16 Update: rubygem-activerecord-3.0.10-4.fc16
2013-01-15 02:22:33
nvd
nvd
CVE-2012-2695
2012-06-22 14:55:01
CVE-2012-2661
2012-06-22 14:55:01
cvelist
cvelist
CVE-2012-2695
2012-06-22 14:00:00
CVE-2012-2661
2012-06-22 14:00:00
gitlab
gitlab
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
2017-10-24 00:00:00
SQL injection vulnerability in Active Record
2012-06-22 00:00:00
nessus
nessus
Fedora 17 : rubygem-activerecord-3.0.11-3.fc17 (2012-9635)
2012-07-01 00:00:00
Fedora 16 : rubygem-activerecord-3.0.10-3.fc16 (2012-9639)
2012-07-01 00:00:00
rubygems
rubygems
CVE-2012-2661 rubygem-activerecord: SQL injection when processing nested query paramaters
2012-05-30 20:00:00
SQL Injection Vulnerability in Ruby on Rails
2017-10-23 21:00:00
suse
suse
Security update for rubygem-actionpack (important)
2012-08-21 19:08:38
Security update for rubygem-activerecord (important)
2012-08-21 20:08:28
Security update for rubygem-activerecord (important)
2012-08-21 19:08:36
seebug
seebug
SQL Injection Vulnerability in Ruby on Rails
2012-06-01 00:00:00
Ruby on Railsε΅ε₯εζ°SQL注ε
₯ζΌζ΄
2012-06-16 00:00:00
checkpoint_advisories
checkpoint_advisories
Ruby on Rails Hash SQL Injection (CVE-2012-2695)
2012-10-14 00:00:00
freebsd
freebsd
rubygem-activerecord -- multiple vulnerabilities
2012-05-31 00:00:00
redhat
redhat
(RHSA-2013:0154) Critical: Ruby on Rails security update
2013-01-10 20:37:00
(RHSA-2013:0582) Moderate: Red Hat OpenShift Enterprise 1.1.1 update
2013-02-28 00:00:00
