CVEvulnerability
CVE-2014-0080
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-02-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.
Affected configurations
• rubyonrails rails 4.0.0
• rubyonrails rails 4.0.1
• rubyonrails rails 4.0.2
• rubyonrails rails 4.1.0
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://openwall.com/lists/oss-security/2014/02/18/9 openwall.com
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/Wu96YkTUR6s/pPLBMZrlwvYJ groups.google.com
- http://openwall.com/lists/oss-security/2014/02/18/9 openwall.com
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/Wu96YkTUR6s/pPLBMZrlwvYJ groups.google.com