CVE-2012-2660
rubygem-actionpack: Unsafe query generation
Severity Score
Exploit Likelihood
Affected Versions
70Public Exploits
1Exploited in Wild
-Decision
Descriptions
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.
actionpack/lib/action_dispatch/http/request.rb en Ruby on Rails antes de v3.0.13, v3.1.x antes de v3.1.5 y v3.2.x antes de v3.2.4 no tienen debidamente en cuenta las diferencias en el manejo de parámetros entre el componente Active Record y la interfaz Rack, lo que permite a atacantes remotos evitar las restricciones de consulta de bases de datos y realizar comprobaciones de nulos a través de una solicitud hecha a mano, por ejemplo con valores "[nil]". Se trata de un problema relacionado con el CVE-2012-2694.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2012-05-14 CVE Reserved
- 2012-06-22 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- 2025-04-08 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (9)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|