CVE-2012-2661
rubyonrails: no CVSS score yet. EPSS 4.0% chance of exploitation in the next 30 days. Fixed in activerecord 3.0.13, 3.1.5, 3.2.4.
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
- EPSS
- 4.0% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-11-01)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fh39-v733-mxfr | RubyGems | activerecord | >=3.0.0 <3.0.13 | 3.0.13 |
| GHSA-fh39-v733-mxfr | RubyGems | activerecord | >=3.1.0 <3.1.5 | 3.1.5 |
| GHSA-fh39-v733-mxfr | RubyGems | activerecord | >=3.2.0 <3.2.4 | 3.2.4 |
References
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
- http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
- http://rhn.redhat.com/errata/RHSA-2013-0154.html
- https://groups.google.com/group/rubyonrails-security/msg/fc2da6c627fc92df?dmode=source&output=gplain