Access Restriction Bypass Affecting rails package, versions <3.0.14 >=3.1.0, <3.1.6 >=3.2.0, <3.2.6
Threat Intelligence
EPSS
0.29% (70th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-RAILS-472695
- published 11 Nov 2019
- disclosed 22 Jun 2012
- credit unknown
Introduced: 22 Jun 2012
CVE-2012-2694 Open this link in a new tabHow to fix?
Upgrade rails to version 3.0.14, 3.1.6, 3.2.6 or higher.
Overview
rails is an opensource MVC web framework.
Affected versions of this package are vulnerable to Access Restriction Bypass. actionpack/lib/action_dispatch/http/request.rb does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain [xyz, nil] values, a related issue to CVE-2012-2660.
CVSS Scores
version 3.1