7.5
CVE-2016-6317
- EPSS 0.35%
- Veröffentlicht 07.09.2016 19:28:11
- Zuletzt bearbeitet 12.04.2025 10:46:40
- Quelle secalert@redhat.com
- Teams Watchlist Login
- Unerledigt Login
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rubyonrails ≫ Rails Version4.2.0
Rubyonrails ≫ Rails Version4.2.0 Updatebeta1
Rubyonrails ≫ Rails Version4.2.0 Updatebeta2
Rubyonrails ≫ Rails Version4.2.0 Updatebeta3
Rubyonrails ≫ Rails Version4.2.0 Updatebeta4
Rubyonrails ≫ Rails Version4.2.0 Updaterc1
Rubyonrails ≫ Rails Version4.2.0 Updaterc2
Rubyonrails ≫ Rails Version4.2.0 Updaterc3
Rubyonrails ≫ Rails Version4.2.1
Rubyonrails ≫ Rails Version4.2.1 Updaterc1
Rubyonrails ≫ Rails Version4.2.1 Updaterc2
Rubyonrails ≫ Rails Version4.2.1 Updaterc3
Rubyonrails ≫ Rails Version4.2.1 Updaterc4
Rubyonrails ≫ Rails Version4.2.2
Rubyonrails ≫ Rails Version4.2.3
Rubyonrails ≫ Rails Version4.2.3 Updaterc1
Rubyonrails ≫ Rails Version4.2.4
Rubyonrails ≫ Rails Version4.2.4 Updaterc1
Rubyonrails ≫ Rails Version4.2.5
Rubyonrails ≫ Rails Version4.2.5 Updaterc1
Rubyonrails ≫ Rails Version4.2.5 Updaterc2
Rubyonrails ≫ Rails Version4.2.5.1
Rubyonrails ≫ Rails Version4.2.5.2
Rubyonrails ≫ Rails Version4.2.6
Rubyonrails ≫ Rails Version4.2.6 Updaterc1
Rubyonrails ≫ Rails Version4.2.7
Rubyonrails ≫ Rails Version4.2.7 Updaterc1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.35% | 0.571 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:P/A:N
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-476 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.