CVE-2013-0155

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active…

published January 13, 2013

CVSS
—
EPSS
8%
Percentile
94.9
In the wild
Unconfirmed
What it is

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08245 · 94.9th percentile
Published
2013-01-13T22:00Z
EPSS history
Timeline
  • 13 JAN 22:00Z
    Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active…
    cvelistv5