GitHub Advisoryadvisory · RubyGems

GHSA-h6w6-xmqv-7q78 activerecord vulnerable to SQL Injection

HIGH Published 2017-10-24 Modified 2025-11-03 Official page ↗
Aliases
CVE-2011-2930
Ecosystem
RubyGems
Packages
activerecord
Severity
High
Weaknesses
CWE-89
Reviewed
2020-06-16

Affected packages

• RubyGems activerecord: >= 2.0.0, < 2.3.13 → fixed in 2.3.13 • RubyGems activerecord: >= 3.0.0.beta, < 3.0.10 → fixed in 3.0.10 • RubyGems activerecord: >= 3.1.0.beta1, < 3.1.0.rc5 → fixed in 3.1.0.rc5

Description

Multiple SQL injection vulnerabilities in the `quote_table_name` method in the ActiveRecord adapters in `activerecord/lib/active_record/connection_adapters/` in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.

Related

Alias · CVE (1)

  • CVE-2011-2930 Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References