CVE-2013-0276
ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.
- EPSS
- 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rubyonrails:rails
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gr44-7grc-37vq | RubyGems | activerecord | <2.3.17 | 2.3.17 |
| GHSA-gr44-7grc-37vq | RubyGems | activerecord | >=3.1.0 <3.1.11 | 3.1.11 |
| GHSA-gr44-7grc-37vq | RubyGems | activerecord | >=3.2.0 <3.2.12 | 3.2.12 |