NVD

Id
29020  
Name
CVE-2014-0080  
Description
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving (backslash) characters that are not properly handled in operations on array columns.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-02-20  
Modified Date
2014-02-20  
Seq
2014-0080  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
153143 29020 CVE-2014-0080 [oss-security] 20140218 Data Injection Vulnerability in Active Record (CVE-2014-0080)  View
153144 29020 CVE-2014-0080 [rubyonrails-security] 20140218 Data Injection Vulnerability in Active Record (CVE-2014-0080)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
12562 JVNDB-2014-001437 Ruby on Rails の Active Record における SQL インジェクションの脆弱性 Ruby on Rails の Active Record の activerecord/lib/active_record/connection_adapters/postgresql/cast.rb には、PostgreSQL が使用されている場合、SQL インジェクションの脆弱性が存在します。 CVE-2014-0080 67481 CVE-2014-0080 29020 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001437.html 2014-02-18 2014-02-21 View