CVE-2014-3482

EPSS 4.28%
Veröffentlicht 07.07.2014 11:01:30
Zuletzt bearbeitet 06.05.2026 22:30:45
Erkennungen
Login

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 11

NVD 125 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Rubyonrails ≫ Rails Version 2.0.0

Rubyonrails ≫ Rails Version 2.0.0 Update rc1

Rubyonrails ≫ Rails Version 2.0.0 Update rc2

Rubyonrails ≫ Rails Version 2.0.1

Rubyonrails ≫ Rails Version 2.0.2

Rubyonrails ≫ Rails Version 2.0.4

Rubyonrails ≫ Rails Version 2.1.0

Rubyonrails ≫ Rails Version 2.1.1

Rubyonrails ≫ Rails Version 2.1.2

Rubyonrails ≫ Rails Version 2.2.0

Rubyonrails ≫ Rails Version 2.2.1

Rubyonrails ≫ Rails Version 2.2.2

Rubyonrails ≫ Rails Version 2.3.0

Rubyonrails ≫ Rails Version 2.3.1

Rubyonrails ≫ Rails Version 2.3.2

Rubyonrails ≫ Rails Version 2.3.3

Rubyonrails ≫ Rails Version 2.3.4

Rubyonrails ≫ Rails Version 2.3.9

Rubyonrails ≫ Rails Version 2.3.10

Rubyonrails ≫ Rails Version 2.3.11

Rubyonrails ≫ Rails Version 2.3.12

Rubyonrails ≫ Rails Version 2.3.13

Rubyonrails ≫ Rails Version 2.3.14

Rubyonrails ≫ Rails Version 2.3.15

Rubyonrails ≫ Rails Version 2.3.16

Rubyonrails ≫ Rails Version 2.3.18

Rubyonrails ≫ Rails Version 3.0.0

Rubyonrails ≫ Rails Version 3.0.0 Update beta

Rubyonrails ≫ Rails Version 3.0.0 Update beta2

Rubyonrails ≫ Rails Version 3.0.0 Update beta3

Rubyonrails ≫ Rails Version 3.0.0 Update beta4

Rubyonrails ≫ Rails Version 3.0.0 Update rc

Rubyonrails ≫ Rails Version 3.0.0 Update rc2

Rubyonrails ≫ Rails Version 3.0.1

Rubyonrails ≫ Rails Version 3.0.1 Update pre

Rubyonrails ≫ Rails Version 3.0.2

Rubyonrails ≫ Rails Version 3.0.2 Update pre

Rubyonrails ≫ Rails Version 3.0.3

Rubyonrails ≫ Rails Version 3.0.4 Update rc1

Rubyonrails ≫ Rails Version 3.0.5

Rubyonrails ≫ Rails Version 3.0.5 Update rc1

Rubyonrails ≫ Rails Version 3.0.6

Rubyonrails ≫ Rails Version 3.0.6 Update rc1

Rubyonrails ≫ Rails Version 3.0.6 Update rc2

Rubyonrails ≫ Rails Version 3.0.7

Rubyonrails ≫ Rails Version 3.0.7 Update rc1

Rubyonrails ≫ Rails Version 3.0.7 Update rc2

Rubyonrails ≫ Rails Version 3.0.8

Rubyonrails ≫ Rails Version 3.0.8 Update rc1

Rubyonrails ≫ Rails Version 3.0.8 Update rc2

Rubyonrails ≫ Rails Version 3.0.8 Update rc3

Rubyonrails ≫ Rails Version 3.0.8 Update rc4

Rubyonrails ≫ Rails Version 3.0.9

Rubyonrails ≫ Rails Version 3.0.9 Update rc1

Rubyonrails ≫ Rails Version 3.0.9 Update rc2

Rubyonrails ≫ Rails Version 3.0.9 Update rc3

Rubyonrails ≫ Rails Version 3.0.9 Update rc4

Rubyonrails ≫ Rails Version 3.0.9 Update rc5

Rubyonrails ≫ Rails Version 3.0.10

Rubyonrails ≫ Rails Version 3.0.10 Update rc1

Rubyonrails ≫ Rails Version 3.0.11

Rubyonrails ≫ Rails Version 3.0.12

Rubyonrails ≫ Rails Version 3.0.12 Update rc1

Rubyonrails ≫ Rails Version 3.0.13

Rubyonrails ≫ Rails Version 3.0.13 Update rc1

Rubyonrails ≫ Rails Version 3.0.14

Rubyonrails ≫ Rails Version 3.0.16

Rubyonrails ≫ Rails Version 3.0.17

Rubyonrails ≫ Rails Version 3.0.18

Rubyonrails ≫ Rails Version 3.0.19

Rubyonrails ≫ Rails Version 3.0.20

Rubyonrails ≫ Rails Version 3.1.0

Rubyonrails ≫ Rails Version 3.1.0 Update beta1

Rubyonrails ≫ Rails Version 3.1.0 Update rc1

Rubyonrails ≫ Rails Version 3.1.0 Update rc2

Rubyonrails ≫ Rails Version 3.1.0 Update rc3

Rubyonrails ≫ Rails Version 3.1.0 Update rc4

Rubyonrails ≫ Rails Version 3.1.0 Update rc5

Rubyonrails ≫ Rails Version 3.1.0 Update rc6

Rubyonrails ≫ Rails Version 3.1.0 Update rc7

Rubyonrails ≫ Rails Version 3.1.0 Update rc8

Rubyonrails ≫ Rails Version 3.1.1

Rubyonrails ≫ Rails Version 3.1.1 Update rc1

Rubyonrails ≫ Rails Version 3.1.1 Update rc2

Rubyonrails ≫ Rails Version 3.1.1 Update rc3

Rubyonrails ≫ Rails Version 3.1.2

Rubyonrails ≫ Rails Version 3.1.2 Update rc1

Rubyonrails ≫ Rails Version 3.1.2 Update rc2

Rubyonrails ≫ Rails Version 3.1.3

Rubyonrails ≫ Rails Version 3.1.4

Rubyonrails ≫ Rails Version 3.1.4 Update rc1

Rubyonrails ≫ Rails Version 3.1.5

Rubyonrails ≫ Rails Version 3.1.5 Update rc1

Rubyonrails ≫ Rails Version 3.1.6

Rubyonrails ≫ Rails Version 3.1.7

Rubyonrails ≫ Rails Version 3.1.8

Rubyonrails ≫ Rails Version 3.1.9

Rubyonrails ≫ Rails Version 3.1.10

Rubyonrails ≫ Rails Version 3.2.0

Rubyonrails ≫ Rails Version 3.2.0 Update rc1

Rubyonrails ≫ Rails Version 3.2.0 Update rc2

Rubyonrails ≫ Rails Version 3.2.1

Rubyonrails ≫ Rails Version 3.2.2

Rubyonrails ≫ Rails Version 3.2.2 Update rc1

Rubyonrails ≫ Rails Version 3.2.3

Rubyonrails ≫ Rails Version 3.2.3 Update rc1

Rubyonrails ≫ Rails Version 3.2.3 Update rc2

Rubyonrails ≫ Rails Version 3.2.4

Rubyonrails ≫ Rails Version 3.2.4 Update rc1

Rubyonrails ≫ Rails Version 3.2.5

Rubyonrails ≫ Rails Version 3.2.6

Rubyonrails ≫ Rails Version 3.2.7

Rubyonrails ≫ Rails Version 3.2.8

Rubyonrails ≫ Rails Version 3.2.9

Rubyonrails ≫ Rails Version 3.2.10

Rubyonrails ≫ Rails Version 3.2.11

Rubyonrails ≫ Rails Version 3.2.12

Rubyonrails ≫ Rails Version 3.2.13 Update rc1

Rubyonrails ≫ Rails Version 3.2.13 Update rc2

Rubyonrails ≫ Rails Version 3.2.15 Update rc3

Rubyonrails ≫ Rails Version 3.2.16

Rubyonrails ≫ Rails Version 3.2.17

Rubyonrails ≫ Rails Version 3.2.18

Rubyonrails ≫ Ruby On Rails Version 2.3.17

Rubyonrails ≫ Ruby On Rails Version 3.0.4

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	4.28%	0.899

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

http://openwall.com/lists/oss-security/2014/07/02/5

http://rhn.redhat.com/errata/RHSA-2014-0876.html

http://secunia.com/advisories/59973

http://secunia.com/advisories/60214

http://secunia.com/advisories/60763

http://www.debian.org/security/2014/dsa-2982

http://www.securityfocus.com/bid/68343

https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J

https://nvd.nist.gov/vuln/detail/CVE-2014-3482

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-3482

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-3482

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2014-3482