Active Record contains SQL Injection
High severity
GitHub Reviewed
Published
Oct 24, 2017
to the GitHub Advisory Database
•
Updated Jan 21, 2025
Package
Affected versions
>= 3.1.0, < 3.1.9
>= 3.2.0, < 3.2.10
>= 3.0.0.beta, < 3.0.18
< 2.3.15
Patched versions
3.1.9
3.2.10
3.0.18
2.3.15
Description
Published by the National Vulnerability Database
Jan 4, 2013
Published to the GitHub Advisory Database
Oct 24, 2017
Reviewed
Jun 16, 2020
Last updated
Jan 21, 2025
Credits
-
levpachmanov Analyst
SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
References