CVE-2008-4094
rubyonrails: no CVSS score yet. EPSS 3.0% chance of exploitation in the next 30 days. Fixed in activerecord 2.1.1.
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
- EPSS
- 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rubyonrails:rails
- rubyonrails:ruby_on_rails
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xf96-32q2-9rw2 | RubyGems | activerecord | <2.1.1 | 2.1.1 |