CVE-2012-2694
rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)
Severity Score
4.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "['xyz', nil]" values, a related issue to CVE-2012-2660.
actionpack/lib/action_dispatch/http/request.rb en Ruby on Rails antes de la version v3.0.14, en la v3.1.x antes de v3.1.6 y v3.2.x antes de v 3.2.6 no considera adecuadamente las diferencias en el manejo de parámetros entre el componente Active Record y la interfaz Rack, lo que permite a atacantes remotos evitar las restricciones de consulta de bases de datos y realizar comprobaciones de nulos a través de solicitudes hechas a mano, por ejemplo con los valores "['xyz', nil]". Es un problema relacionado con el CVE-2012-2660.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2012-05-14 CVE Reserved
- 2012-06-22 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- 2024-08-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-264: Permissions, Privileges, and Access Controls
- CWE-305: Authentication Bypass by Primary Weakness
CAPEC
References (9)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://groups.google.com/group/rubyonrails-security/msg/e2d3a87f2c211def?dmode=source&output=gplain | 2024-08-06 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | beta |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | beta2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | beta3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | beta4 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | rc |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.0 Search vendor "Rubyonrails" for product "Rails" and version "3.0.0" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.1 Search vendor "Rubyonrails" for product "Rails" and version "3.0.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.1 Search vendor "Rubyonrails" for product "Rails" and version "3.0.1" | pre |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.2 Search vendor "Rubyonrails" for product "Rails" and version "3.0.2" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.2 Search vendor "Rubyonrails" for product "Rails" and version "3.0.2" | pre |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.3 Search vendor "Rubyonrails" for product "Rails" and version "3.0.3" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.4 Search vendor "Rubyonrails" for product "Rails" and version "3.0.4" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.5 Search vendor "Rubyonrails" for product "Rails" and version "3.0.5" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.5 Search vendor "Rubyonrails" for product "Rails" and version "3.0.5" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.6 Search vendor "Rubyonrails" for product "Rails" and version "3.0.6" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.6 Search vendor "Rubyonrails" for product "Rails" and version "3.0.6" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.6 Search vendor "Rubyonrails" for product "Rails" and version "3.0.6" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.7 Search vendor "Rubyonrails" for product "Rails" and version "3.0.7" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.7 Search vendor "Rubyonrails" for product "Rails" and version "3.0.7" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.7 Search vendor "Rubyonrails" for product "Rails" and version "3.0.7" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.8 Search vendor "Rubyonrails" for product "Rails" and version "3.0.8" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.8 Search vendor "Rubyonrails" for product "Rails" and version "3.0.8" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.8 Search vendor "Rubyonrails" for product "Rails" and version "3.0.8" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.8 Search vendor "Rubyonrails" for product "Rails" and version "3.0.8" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.8 Search vendor "Rubyonrails" for product "Rails" and version "3.0.8" | rc4 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.9 Search vendor "Rubyonrails" for product "Rails" and version "3.0.9" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.9 Search vendor "Rubyonrails" for product "Rails" and version "3.0.9" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.9 Search vendor "Rubyonrails" for product "Rails" and version "3.0.9" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.9 Search vendor "Rubyonrails" for product "Rails" and version "3.0.9" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.9 Search vendor "Rubyonrails" for product "Rails" and version "3.0.9" | rc4 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.9 Search vendor "Rubyonrails" for product "Rails" and version "3.0.9" | rc5 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.10 Search vendor "Rubyonrails" for product "Rails" and version "3.0.10" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.10 Search vendor "Rubyonrails" for product "Rails" and version "3.0.10" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.11 Search vendor "Rubyonrails" for product "Rails" and version "3.0.11" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.12 Search vendor "Rubyonrails" for product "Rails" and version "3.0.12" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.12 Search vendor "Rubyonrails" for product "Rails" and version "3.0.12" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.0.13 Search vendor "Rubyonrails" for product "Rails" and version "3.0.13" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | <= 3.0.13 Search vendor "Rubyonrails" for product "Ruby On Rails" and version " <= 3.0.13" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 3.0.4 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "3.0.4" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | beta1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc4 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc5 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc6 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc7 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc8 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.1 Search vendor "Rubyonrails" for product "Rails" and version "3.1.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.1 Search vendor "Rubyonrails" for product "Rails" and version "3.1.1" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.1 Search vendor "Rubyonrails" for product "Rails" and version "3.1.1" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.1 Search vendor "Rubyonrails" for product "Rails" and version "3.1.1" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.2 Search vendor "Rubyonrails" for product "Rails" and version "3.1.2" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.2 Search vendor "Rubyonrails" for product "Rails" and version "3.1.2" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.2 Search vendor "Rubyonrails" for product "Rails" and version "3.1.2" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.3 Search vendor "Rubyonrails" for product "Rails" and version "3.1.3" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.4 Search vendor "Rubyonrails" for product "Rails" and version "3.1.4" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.4 Search vendor "Rubyonrails" for product "Rails" and version "3.1.4" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.5 Search vendor "Rubyonrails" for product "Rails" and version "3.1.5" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.5 Search vendor "Rubyonrails" for product "Rails" and version "3.1.5" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.0 Search vendor "Rubyonrails" for product "Rails" and version "3.2.0" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.0 Search vendor "Rubyonrails" for product "Rails" and version "3.2.0" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.0 Search vendor "Rubyonrails" for product "Rails" and version "3.2.0" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.1 Search vendor "Rubyonrails" for product "Rails" and version "3.2.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.2 Search vendor "Rubyonrails" for product "Rails" and version "3.2.2" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.2 Search vendor "Rubyonrails" for product "Rails" and version "3.2.2" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.3 Search vendor "Rubyonrails" for product "Rails" and version "3.2.3" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.3 Search vendor "Rubyonrails" for product "Rails" and version "3.2.3" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.3 Search vendor "Rubyonrails" for product "Rails" and version "3.2.3" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.4 Search vendor "Rubyonrails" for product "Rails" and version "3.2.4" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.4 Search vendor "Rubyonrails" for product "Rails" and version "3.2.4" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.5 Search vendor "Rubyonrails" for product "Rails" and version "3.2.5" | - |
Affected
| ||||||