SQL Injection Affecting update_by_case package, versions <0.1.3
Threat Intelligence
EPSS
0.18% (57th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-UPDATEBYCASE-2980124
- published 12 Aug 2022
- disclosed 11 Aug 2022
- credit Unknown
Introduced: 11 Aug 2022
CVE-2022-35956 Open this link in a new tabHow to fix?
Upgrade update_by_case to version 0.1.3 or higher.
Overview
update_by_case is an a package that allows you to update multiple ActiveRecord records based on case values on a single database hit
Affected versions of this package are vulnerable to SQL Injection in the UpdateByCase and Utils classes, which accept and process SQL strings without sanitization.
References
CVSS Scores
version 3.1