SQL Injection in Rubyonrails Rails
CVE-2014-3482
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL…
Vulnerability class: SQL Injection
EPSS: 0.015 (81.7th percentile) — read the EPSS interpretation.
Affected products
- Rubyonrails Rails — versions 2.0.0, 2.0.1, 2.0.2
- Rubyonrails Ruby_on_rails — versions 2.3.17, 3.0.4
- N/a — versions n/a
Weakness classification (CWE)
References
- 68343 (vdb-entry, x_refsource_BID)
- 59973 (x_refsource_SECUNIA, third-party-advisory)
- [oss-security] 20140702 [CVE-2014-3482] [CVE-2014-3483] Ruby on Rails: Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQL (mailing-list, x_refsource_MLIST)
- [rubyonrails-security] 20140702 [CVE-2014-3482] [CVE-2014-3483] Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQL (mailing-list, x_refsource_MLIST)
- 60214 (x_refsource_SECUNIA, third-party-advisory)
- 60763 (x_refsource_SECUNIA, third-party-advisory)
- RHSA-2014:0876 (x_refsource_REDHAT, vendor-advisory)
- DSA-2982 (vendor-advisory, x_refsource_DEBIAN)