Fluid Attacks Database

Description

activerecord vulnerable to SQL Injection The Active Record component in Ruby on Rails efore 2.3.15, 3.0.x before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rubygems	activerecord	>=3.0.0.beta <3.0.14 \|\| >=3.1.0 <3.1.6 \|\| >=3.2.0 <3.2.6 \|\| >=0 <2.3.15	3.0.14, 3.1.6, 3.2.6, 2.3.15

Aliases

1. CVE-2012-26952. NVD-2012-26953. OSV-2012-26954. GCVE-2012-2695

References

1. https://github.com/rails/rails/commit/62f81f4d6b3ee40e9887ffd92ab14714bad93f182. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2012-2695.yml3. https://groups.google.com/g/rubyonrails-security/c/l4L0TEVAz1k/m/Vr84sD9B464J4. https://groups.google.com/group/rubyonrails-security/msg/aee3413fb038bf56?dmode=source&output=gplain5. http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html6. http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html7. http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html8. http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html9. http://rhn.redhat.com/errata/RHSA-2013-0154.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.