Data Injection Affecting activerecord package, versions >=2.3.2, <4.0.0.beta1


0.0
high
  • Attack Complexity

    Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-RUBY-ACTIVERECORD-1314522

  • published

    25 Jun 2021

  • disclosed

    21 Apr 2013

  • credit

    Unknown

How to fix?

Upgrade activerecord to version 4.0.0.beta1 or higher.

Overview

activerecord is a library for databases on Rails.

Affected versions of this package are vulnerable to Data Injection. It does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.