Description
SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 12 | | =2:6.1.7.10+dfsg-1~deb12u1 || =2:6.1.7.10+dfsg-1~deb12u2 || =2:6.1.7.3+dfsg-1 || =2:6.1.7.3+dfsg-10 || =2:6.1.7.3+dfsg-11 || =2:6.1.7.3+dfsg-12 || =2:6.1.7.3+dfsg-13 || =2:6.1.7.3+dfsg-2 || =2:6.1.7.3+dfsg-2~deb12u1 || =2:6.1.7.3+dfsg-3 || =2:6.1.7.3+dfsg-4 || =2:6.1.7.3+dfsg-5 || =2:6.1.7.3+dfsg-6 || =2:6.1.7.3+dfsg-7 || =2:6.1.7.3+dfsg-7~exp1 || =2:6.1.7.3+dfsg-8 || =2:6.1.7.3+dfsg-9 || =2:7.2.2.1+dfsg-1 || =2:7.2.2.1+dfsg-1~exp1 || =2:7.2.2.1+dfsg-1~exp2 || =2:7.2.2.1+dfsg-1~exp3 || =2:7.2.2.1+dfsg-1~exp4 || =2:7.2.2.1+dfsg-1~exp6 || =2:7.2.2.1+dfsg-2 || =2:7.2.2.1+dfsg-3 || =2:7.2.2.1+dfsg-4 || =2:7.2.2.1+dfsg-5 || =2:7.2.2.1+dfsg-6 || =2:7.2.2.1+dfsg-7 || =2:7.2.2.2+dfsg-1 || =2:7.2.2.2+dfsg-2 || =2:7.2.2.2+dfsg-2~deb13u1 || =2:7.2.3+dfsg-1 || =2:7.2.3+dfsg-2 || =2:7.2.3+dfsg-3 || =2:7.2.3.1+dfsg-1 || =2:7.2.3.2+dfsg-1 || =2:7.2.3.2+dfsg-2 |
debian 13 | | =2:7.2.2.1+dfsg-7 || =2:7.2.2.2+dfsg-1 || =2:7.2.2.2+dfsg-2 || =2:7.2.2.2+dfsg-2~deb13u1 || =2:7.2.3+dfsg-1 || =2:7.2.3+dfsg-2 || =2:7.2.3+dfsg-3 || =2:7.2.3.1+dfsg-1 || =2:7.2.3.2+dfsg-1 || =2:7.2.3.2+dfsg-2 |
debian 14 | | =2:7.2.2.1+dfsg-7 || =2:7.2.2.2+dfsg-1 || =2:7.2.2.2+dfsg-2 || =2:7.2.2.2+dfsg-2~deb13u1 || =2:7.2.3+dfsg-1 || =2:7.2.3+dfsg-2 || =2:7.2.3+dfsg-3 || =2:7.2.3.1+dfsg-1 || =2:7.2.3.2+dfsg-1 || =2:7.2.3.2+dfsg-2 |
