CVE-2012-2695

The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data…

published June 22, 2012

CVSS
—
EPSS
3%
Percentile
87.1
In the wild
Unconfirmed
What it is

The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02981 · 87.1th percentile
Published
2012-06-22T14:00Z
EPSS history
Timeline
  • 22 JUN 14:00Z
    The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data…
    cvelistv5