7.5
CVE-2012-2695
- EPSS 2.92%
- Veröffentlicht 22.06.2012 14:55:01
- Zuletzt bearbeitet 16.06.2026 23:41:54
- Erkennungen
LoginThe Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rubyonrails ≫ Rails Version 3.0.0
Rubyonrails ≫ Rails Version 3.0.0 Update beta
Rubyonrails ≫ Rails Version 3.0.0 Update beta2
Rubyonrails ≫ Rails Version 3.0.0 Update beta3
Rubyonrails ≫ Rails Version 3.0.0 Update beta4
Rubyonrails ≫ Rails Version 3.0.0 Update rc
Rubyonrails ≫ Rails Version 3.0.0 Update rc2
Rubyonrails ≫ Rails Version 3.0.1
Rubyonrails ≫ Rails Version 3.0.1 Update pre
Rubyonrails ≫ Rails Version 3.0.2
Rubyonrails ≫ Rails Version 3.0.2 Update pre
Rubyonrails ≫ Rails Version 3.0.3
Rubyonrails ≫ Rails Version 3.0.4 Update rc1
Rubyonrails ≫ Rails Version 3.0.5
Rubyonrails ≫ Rails Version 3.0.5 Update rc1
Rubyonrails ≫ Rails Version 3.0.6
Rubyonrails ≫ Rails Version 3.0.6 Update rc1
Rubyonrails ≫ Rails Version 3.0.6 Update rc2
Rubyonrails ≫ Rails Version 3.0.7
Rubyonrails ≫ Rails Version 3.0.7 Update rc1
Rubyonrails ≫ Rails Version 3.0.7 Update rc2
Rubyonrails ≫ Rails Version 3.0.8
Rubyonrails ≫ Rails Version 3.0.8 Update rc1
Rubyonrails ≫ Rails Version 3.0.8 Update rc2
Rubyonrails ≫ Rails Version 3.0.8 Update rc3
Rubyonrails ≫ Rails Version 3.0.8 Update rc4
Rubyonrails ≫ Rails Version 3.0.9
Rubyonrails ≫ Rails Version 3.0.9 Update rc1
Rubyonrails ≫ Rails Version 3.0.9 Update rc2
Rubyonrails ≫ Rails Version 3.0.9 Update rc3
Rubyonrails ≫ Rails Version 3.0.9 Update rc4
Rubyonrails ≫ Rails Version 3.0.9 Update rc5
Rubyonrails ≫ Rails Version 3.0.10
Rubyonrails ≫ Rails Version 3.0.10 Update rc1
Rubyonrails ≫ Rails Version 3.0.11
Rubyonrails ≫ Rails Version 3.0.12
Rubyonrails ≫ Rails Version 3.0.12 Update rc1
Rubyonrails ≫ Rails Version 3.0.13 Update rc1
Rubyonrails ≫ Ruby On Rails Version <= 3.0.13
Rubyonrails ≫ Ruby On Rails Version 3.0.4
Rubyonrails ≫ Rails Version 3.1.0
Rubyonrails ≫ Rails Version 3.1.0 Update beta1
Rubyonrails ≫ Rails Version 3.1.0 Update rc1
Rubyonrails ≫ Rails Version 3.1.0 Update rc2
Rubyonrails ≫ Rails Version 3.1.0 Update rc3
Rubyonrails ≫ Rails Version 3.1.0 Update rc4
Rubyonrails ≫ Rails Version 3.1.0 Update rc5
Rubyonrails ≫ Rails Version 3.1.0 Update rc6
Rubyonrails ≫ Rails Version 3.1.0 Update rc7
Rubyonrails ≫ Rails Version 3.1.0 Update rc8
Rubyonrails ≫ Rails Version 3.1.1
Rubyonrails ≫ Rails Version 3.1.1 Update rc1
Rubyonrails ≫ Rails Version 3.1.1 Update rc2
Rubyonrails ≫ Rails Version 3.1.1 Update rc3
Rubyonrails ≫ Rails Version 3.1.2
Rubyonrails ≫ Rails Version 3.1.2 Update rc1
Rubyonrails ≫ Rails Version 3.1.2 Update rc2
Rubyonrails ≫ Rails Version 3.1.3
Rubyonrails ≫ Rails Version 3.1.4
Rubyonrails ≫ Rails Version 3.1.4 Update rc1
Rubyonrails ≫ Rails Version 3.1.5
Rubyonrails ≫ Rails Version 3.1.5 Update rc1
Rubyonrails ≫ Rails Version 3.2.0
Rubyonrails ≫ Rails Version 3.2.0 Update rc1
Rubyonrails ≫ Rails Version 3.2.0 Update rc2
Rubyonrails ≫ Rails Version 3.2.1
Rubyonrails ≫ Rails Version 3.2.2
Rubyonrails ≫ Rails Version 3.2.2 Update rc1
Rubyonrails ≫ Rails Version 3.2.3
Rubyonrails ≫ Rails Version 3.2.3 Update rc1
Rubyonrails ≫ Rails Version 3.2.3 Update rc2
Rubyonrails ≫ Rails Version 3.2.4
Rubyonrails ≫ Rails Version 3.2.4 Update rc1
Rubyonrails ≫ Rails Version 3.2.5
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.92% | 0.853 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
http://rhn.redhat.com/errata/RHSA-2013-0154.html
https://groups.google.com/group/rubyonrails-security/msg/aee3413fb038bf56?dmode=source&output=gplain