CVEvulnerability

CVE-2023-22794

8.8 HIGH Published 2023-02-09 Modified 2026-10-23 Official page ↗
Status
Modified
Published
2023-02-09
Last modified
2026-10-23
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89

Description

A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.

Affected configurations

• activerecord project activerecord (>= 6.0.0 < 6.0.6.1) • activerecord project activerecord (>= 6.1.0 < 6.1.7.1) • activerecord project activerecord (>= 7.0.0 < 7.0.4.1)

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References