The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the

Summary

The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.

Timeline

1. Jun 22, 2012, 2:00 PM UTCCVE published
2. Aug 6, 2024, 7:42 PM UTCRecord last updated

Affected versions

• n/a n/a

  Version range not reported

• activerecordRubyGems

  From 3.0.0 · fixed in 3.0.13

• activerecordRubyGems

  From 3.1.0 · fixed in 3.1.5

• activerecordRubyGems

  From 3.2.0 · fixed in 3.2.4

References 6