// For flags

CVE-2012-2695

rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661)

Severity Score

7.5
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.

El componente 'Active Record' en Ruby on Rails antes de la version v3.0.14, v3.1.x antes de v3.1.6 y v3.2.x antes de v3.2.6 no implementa correctamente el paso de los datos de la solicitud a un método 'where' en la clase ActiveRecord, lo que permite llevar a cabo determinados ataques de inyección SQL a atacantes remotos a través de los parámetros de consulta anidadas que aprovechan una indebida manipulación de los hashes anidados. Es un problema relacionado con el CVE-2012-2661.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2012-05-14 CVE Reserved
  • 2012-06-22 CVE Published
  • 2024-07-11 EPSS Updated
  • 2024-08-06 CVE Updated
  • 2024-08-06 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.0
Search vendor "Rubyonrails" for product "Rails" and version "3.0.0"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.0
Search vendor "Rubyonrails" for product "Rails" and version "3.0.0"
beta
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.0
Search vendor "Rubyonrails" for product "Rails" and version "3.0.0"
beta2
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.0
Search vendor "Rubyonrails" for product "Rails" and version "3.0.0"
beta3
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.0
Search vendor "Rubyonrails" for product "Rails" and version "3.0.0"
beta4
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.0
Search vendor "Rubyonrails" for product "Rails" and version "3.0.0"
rc
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.0
Search vendor "Rubyonrails" for product "Rails" and version "3.0.0"
rc2
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.1
Search vendor "Rubyonrails" for product "Rails" and version "3.0.1"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.1
Search vendor "Rubyonrails" for product "Rails" and version "3.0.1"
pre
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.2
Search vendor "Rubyonrails" for product "Rails" and version "3.0.2"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.2
Search vendor "Rubyonrails" for product "Rails" and version "3.0.2"
pre
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.3
Search vendor "Rubyonrails" for product "Rails" and version "3.0.3"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.4
Search vendor "Rubyonrails" for product "Rails" and version "3.0.4"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.5
Search vendor "Rubyonrails" for product "Rails" and version "3.0.5"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.5
Search vendor "Rubyonrails" for product "Rails" and version "3.0.5"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.6
Search vendor "Rubyonrails" for product "Rails" and version "3.0.6"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.6
Search vendor "Rubyonrails" for product "Rails" and version "3.0.6"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.6
Search vendor "Rubyonrails" for product "Rails" and version "3.0.6"
rc2
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.7
Search vendor "Rubyonrails" for product "Rails" and version "3.0.7"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.7
Search vendor "Rubyonrails" for product "Rails" and version "3.0.7"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.7
Search vendor "Rubyonrails" for product "Rails" and version "3.0.7"
rc2
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.8
Search vendor "Rubyonrails" for product "Rails" and version "3.0.8"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.8
Search vendor "Rubyonrails" for product "Rails" and version "3.0.8"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.8
Search vendor "Rubyonrails" for product "Rails" and version "3.0.8"
rc2
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.8
Search vendor "Rubyonrails" for product "Rails" and version "3.0.8"
rc3
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.8
Search vendor "Rubyonrails" for product "Rails" and version "3.0.8"
rc4
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.9
Search vendor "Rubyonrails" for product "Rails" and version "3.0.9"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.9
Search vendor "Rubyonrails" for product "Rails" and version "3.0.9"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.9
Search vendor "Rubyonrails" for product "Rails" and version "3.0.9"
rc2
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.9
Search vendor "Rubyonrails" for product "Rails" and version "3.0.9"
rc3
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.9
Search vendor "Rubyonrails" for product "Rails" and version "3.0.9"
rc4
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.9
Search vendor "Rubyonrails" for product "Rails" and version "3.0.9"
rc5
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.10
Search vendor "Rubyonrails" for product "Rails" and version "3.0.10"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.10
Search vendor "Rubyonrails" for product "Rails" and version "3.0.10"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.11
Search vendor "Rubyonrails" for product "Rails" and version "3.0.11"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.12
Search vendor "Rubyonrails" for product "Rails" and version "3.0.12"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.12
Search vendor "Rubyonrails" for product "Rails" and version "3.0.12"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.0.13
Search vendor "Rubyonrails" for product "Rails" and version "3.0.13"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Ruby On Rails
Search vendor "Rubyonrails" for product "Ruby On Rails"
<= 3.0.13
Search vendor "Rubyonrails" for product "Ruby On Rails" and version " <= 3.0.13"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Ruby On Rails
Search vendor "Rubyonrails" for product "Ruby On Rails"
3.0.4
Search vendor "Rubyonrails" for product "Ruby On Rails" and version "3.0.4"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.0
Search vendor "Rubyonrails" for product "Rails" and version "3.1.0"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.0
Search vendor "Rubyonrails" for product "Rails" and version "3.1.0"
beta1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.0
Search vendor "Rubyonrails" for product "Rails" and version "3.1.0"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.0
Search vendor "Rubyonrails" for product "Rails" and version "3.1.0"
rc2
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.0
Search vendor "Rubyonrails" for product "Rails" and version "3.1.0"
rc3
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.0
Search vendor "Rubyonrails" for product "Rails" and version "3.1.0"
rc4
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.0
Search vendor "Rubyonrails" for product "Rails" and version "3.1.0"
rc5
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.0
Search vendor "Rubyonrails" for product "Rails" and version "3.1.0"
rc6
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.0
Search vendor "Rubyonrails" for product "Rails" and version "3.1.0"
rc7
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.0
Search vendor "Rubyonrails" for product "Rails" and version "3.1.0"
rc8
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.1
Search vendor "Rubyonrails" for product "Rails" and version "3.1.1"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.1
Search vendor "Rubyonrails" for product "Rails" and version "3.1.1"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.1
Search vendor "Rubyonrails" for product "Rails" and version "3.1.1"
rc2
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.1
Search vendor "Rubyonrails" for product "Rails" and version "3.1.1"
rc3
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.2
Search vendor "Rubyonrails" for product "Rails" and version "3.1.2"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.2
Search vendor "Rubyonrails" for product "Rails" and version "3.1.2"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.2
Search vendor "Rubyonrails" for product "Rails" and version "3.1.2"
rc2
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.3
Search vendor "Rubyonrails" for product "Rails" and version "3.1.3"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.4
Search vendor "Rubyonrails" for product "Rails" and version "3.1.4"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.4
Search vendor "Rubyonrails" for product "Rails" and version "3.1.4"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.5
Search vendor "Rubyonrails" for product "Rails" and version "3.1.5"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.1.5
Search vendor "Rubyonrails" for product "Rails" and version "3.1.5"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.2.0
Search vendor "Rubyonrails" for product "Rails" and version "3.2.0"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.2.0
Search vendor "Rubyonrails" for product "Rails" and version "3.2.0"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.2.0
Search vendor "Rubyonrails" for product "Rails" and version "3.2.0"
rc2
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.2.1
Search vendor "Rubyonrails" for product "Rails" and version "3.2.1"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.2.2
Search vendor "Rubyonrails" for product "Rails" and version "3.2.2"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.2.2
Search vendor "Rubyonrails" for product "Rails" and version "3.2.2"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.2.3
Search vendor "Rubyonrails" for product "Rails" and version "3.2.3"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.2.3
Search vendor "Rubyonrails" for product "Rails" and version "3.2.3"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.2.3
Search vendor "Rubyonrails" for product "Rails" and version "3.2.3"
rc2
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.2.4
Search vendor "Rubyonrails" for product "Rails" and version "3.2.4"
-
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.2.4
Search vendor "Rubyonrails" for product "Rails" and version "3.2.4"
rc1
Affected
Rubyonrails
Search vendor "Rubyonrails"
Rails
Search vendor "Rubyonrails" for product "Rails"
3.2.5
Search vendor "Rubyonrails" for product "Rails" and version "3.2.5"
-
Affected