CVEvulnerability
CVE-2011-0448
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2011-02-21
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
Affected configurations
• rubyonrails rails 3.0.0
• rubyonrails rails 3.0.1
• rubyonrails rails 3.0.2
• rubyonrails rails 3.0.3
• rubyonrails rails 3.0.4
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://groups.google.com/group/rubyonrails-security/msg/4e19864cf6ad40ad?dmode=source&output=gplain Patch
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html lists.fedoraproject.org
- http://secunia.com/advisories/43278 Vendor Advisory
- http://securitytracker.com/id?1025063 securitytracker.com
- http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4 Patch
- http://www.vupen.com/english/advisories/2011/0877 www.vupen.com
- https://github.com/rails/rails/commit/354da43ab0a10b3b7b3f9cb0619aa562c3be8474 github.com
- http://groups.google.com/group/rubyonrails-security/msg/4e19864cf6ad40ad?dmode=source&output=gplain Patch
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html lists.fedoraproject.org
- http://secunia.com/advisories/43278 Vendor Advisory
- http://securitytracker.com/id?1025063 securitytracker.com
- http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4 Patch
- http://www.vupen.com/english/advisories/2011/0877 www.vupen.com
- https://github.com/rails/rails/commit/354da43ab0a10b3b7b3f9cb0619aa562c3be8474 github.com