GitHub Advisoryadvisory · RubyGems

GHSA-mhwp-qhpc-h3jm SQL Injection in Active Record

HIGH Published 2017-10-24 Modified 2025-03-31 Official page ↗
Aliases
CVE-2014-3482
Ecosystem
RubyGems
Packages
activerecord
Severity
High
Weaknesses
CWE-89
Reviewed
2020-06-16

Affected packages

• RubyGems activerecord: >= 2.0.0, < 3.2.19 → fixed in 3.2.19

Description

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.

Related

Alias · CVE (1)

  • CVE-2014-3482 SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References