CVEvulnerability

CVE-2016-6317

7.5 HIGH Published 2016-09-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-09-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-284, CWE-476

Description

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.

Affected configurations

• rubyonrails rails 4.2.0 • rubyonrails rails 4.2.1 • rubyonrails rails 4.2.2 • rubyonrails rails 4.2.3 • rubyonrails rails 4.2.4 • rubyonrails rails 4.2.5 • rubyonrails rails 4.2.5.1 • rubyonrails rails 4.2.5.2 • rubyonrails rails 4.2.6 • rubyonrails rails 4.2.7

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-476 NULL Pointer Dereference weakness

References