GitHub Advisoryadvisory · RubyGems

GHSA-xf96-32q2-9rw2 Rails ActiveRecord gem vulnerable to SQL injection

HIGH Published 2017-10-24 Modified 2023-05-26 Official page ↗
Aliases
CVE-2008-4094
Ecosystem
RubyGems
Packages
activerecord
Severity
High
Weaknesses
CWE-89
Reviewed
2020-06-16

Affected packages

• RubyGems activerecord: < 2.1.1 → fixed in 2.1.1

Description

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) `:limit` and (2) `:offset` parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.

Related

Alias · CVE (1)

  • CVE-2008-4094 Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1)… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References