Sha256: 7ef6c7dcc77687cc5fcde3453fbd5ec87a6f637c05d262bf51e5bdf41512043f
Contents?: true
Size: 729 Bytes
Versions: 14
Compression:
Stored size: 729 Bytes
Contents
--- gem: activerecord framework: rails cve: 2013-0155 osvdb: 89025 url: http://osvdb.org/show/osvdb/89025 title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass date: 2013-01-08 description: | Ruby on Rails contains a flaw in the Active Record. The issue is due to an error with the way the Active Record handles parameters combined with an error during the parsing of the JSON parameters. This may allow a remote attacker to bypass restrictions abd issue unexpected database queries with "IS NULL" or empty where clauses, and forcing the query to unexpectedly check for NULL or eliminate a WHERE clause. cvss_v2: 10.0 patched_versions: - ~> 2.3.16 - ~> 3.0.19 - ~> 3.1.10 - ">= 3.2.11"
Version data entries
14 entries across 14 versions & 3 rubygems