Data Injection Affecting activerecord package, versions >=2.3.2, <4.0.0.beta1
Threat Intelligence
EPSS
0.86% (83rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-ACTIVERECORD-1314522
- published 25 Jun 2021
- disclosed 21 Apr 2013
- credit Unknown
Introduced: 21 Apr 2013
CVE-2013-3221 Open this link in a new tabHow to fix?
Upgrade activerecord to version 4.0.0.beta1 or higher.
Overview
activerecord is a library for databases on Rails.
Affected versions of this package are vulnerable to Data Injection. It does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
References
CVSS Scores
version 3.1