GitHub Advisoryadvisory · RubyGems

GHSA-r8fh-hq2p-7qhq Active Record contains SQL Injection via improper range quoting

HIGH Published 2017-10-24 Modified 2023-03-14 Official page ↗
Aliases
CVE-2014-3483
Ecosystem
RubyGems
Packages
activerecord
Severity
High
Weaknesses
CWE-89
Reviewed
2020-06-16

Affected packages

• RubyGems activerecord: >= 4.0.0, < 4.0.7 → fixed in 4.0.7 • RubyGems activerecord: >= 4.1.0, < 4.1.3 → fixed in 4.1.3

Description

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.

Related

Alias · CVE (1)

  • CVE-2014-3483 SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References