CVE-2013-6417

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling…

published December 7, 2013

CVSS
—
EPSS
2%
Percentile
83.7
In the wild
Unconfirmed
What it is

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02371 · 83.7th percentile
Published
2013-12-07T00:00Z
EPSS history
Timeline
  • 07 DEC 00:00Z
    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling…
    cvelistv5