Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2012-2694
4.3
MEDIUMCVSS v2
Published
June 22, 2012
Affected
2 projects
Assigned by
Red Hat
Severity scale
010
Description
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "['xyz', nil]" values, a related issue to CVE-2012-2660.
rails
RubyGemsRuby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
RubyGemsRuby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.= 3.0.0, = 3.0.1, = 3.0.12, = 3.0.4, = 3.0.7, = 3.0.13, = 3.0.2, = 3.0.3, = 3.0.6, = 3.0.11, = 3.0.10, = 3.0.5, = 3.0.9, = 3.0.8, = 3.1.0, = 3.1.2, = 3.1.4, = 3.1.5, = 3.1.1, = 3.1.3, = 3.2.0, = 3.2.1, = 3.2.5, = 3.2.2, = 3.2.3, = 3.2.4NVD
rails/rails
GitHubRuby on Rails
GitHubRuby on Rails= 3.0.0, = 3.0.1, = 3.0.12, = 3.0.4, = 3.0.7, = 3.0.13, = 3.0.2, = 3.0.3, = 3.0.6, = 3.0.11, = 3.0.10, = 3.0.5, = 3.0.9, = 3.0.8, = 3.1.0, = 3.1.2, = 3.1.4, = 3.1.5, = 3.1.1, = 3.1.3, = 3.2.0, = 3.2.1, = 3.2.5, = 3.2.2, = 3.2.3, = 3.2.4NVD