Unsafe Query Generation Affecting activerecord package, versions < 3.2.4, >= 3.2 < 3.1.5, >= 3.1 < 3.0.13
Threat Intelligence
EPSS
0.34% (72nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-ACTIVERECORD-20030
- published 30 May 2012
- disclosed 30 May 2012
- credit Ben Murphy
Introduced: 30 May 2012
CVE-2012-2660 Open this link in a new tabHow to fix?
Upgrade activepark to version 3.2.4, 3.1.5, 3.0.13 or higher.
Overview
ActiveRecord is the Object-Relational Mapping (ORM) that comes out-of-the-box with Rails. It plays the role of Model in the MVC architecture employed by Rails.
The vulnerability lies within the way ActiveRecord handles parameters in conjunction with the way Rack parses query parameters.
This issue may allow an attacker to inject arbitrary IS NULL clauses in to application SQL queries. This may also allow an attacker to have the SQL query check for NULL in arbitrary places.
References
CVSS Scores
version 3.1