Homepage
About Snyk

Data Injection Affecting activerecord package, versions >=2.3.2, <4.0.0.beta1

0.0
high

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.86% (83rd percentile)
Expand this section
NVD
6.5 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-ACTIVERECORD-1314522
  • published 25 Jun 2021
  • disclosed 21 Apr 2013
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 21 Apr 2013

CVE-2013-3221 Open this link in a new tab
CWE-74 Open this link in a new tab

How to fix?

Upgrade activerecord to version 4.0.0.beta1 or higher.

Overview

activerecord is a library for databases on Rails.

Affected versions of this package are vulnerable to Data Injection. It does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.