CVE-2014-3514

activerecord/lib/active_record/relation/query_methods.rb en Active Record en Ruby on Rails 4.0.x anterior a 4.0.9 y 4.1.x anterior a 4.1.5 permite a atacantes remotos evadir el mecanismo de protección de parámetros fuertes a través de entradas manipuladas en una aplicación que realiza llamadas create_with.

It was discovered that Active Record's create_with method failed to properly check attributes passed to it. A remote attacker could possibly use this flaw to bypass the strong parameter protection and modify arbitrary model attributes via mass assignment if an application using Active Record called create_with with untrusted values.

Ruby on Rails is a model-view-controller framework for web application development. Active Record implements object-relational mapping for accessing database entries using objects. It was discovered that Active Record's create_with method failed to properly check attributes passed to it. A remote attacker could possibly use this flaw to bypass the strong parameter protection and modify arbitrary model attributes via mass assignment if an application using Active Record called create_with with untrusted values. All ror40-rubygem-activerecord users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.