CVE-2012-2661 rubygem-activerecord: SQL injection when processing nested query paramaters
Published: May 31, 2012
SECURITY IDENTIFIERS
- CVE: CVE-2012-2661 (NVD)
- GHSA: GHSA-fh39-v733-mxfr
- OSVDB: OSVDB-82403
GEM
FRAMEWORK
SEVERITY
CVSS v2.0: 5.0 (Medium)
UNAFFECTED VERSIONS
~> 2.3.14
PATCHED VERSIONS
~> 3.0.13
~> 3.1.5
>= 3.2.4
DESCRIPTION
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.