NVD

Id
44380  
Name
CVE-2012-2661  
Description
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2012-06-22  
Modified Date
2013-02-06  
Seq
2012-2661  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
222612 44380 CVE-2012-2661 SUSE-SU-2012:1012  View
222613 44380 CVE-2012-2661 SUSE-SU-2012:1014  View
222614 44380 CVE-2012-2661 openSUSE-SU-2012:1066  View
222615 44380 CVE-2012-2661 RHSA-2013:0154  View
222616 44380 CVE-2012-2661 [rubyonrails-security] 20120531 SQL Injection Vulnerability in Ruby on Rails (CVE-2012-2661)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
27153 JVNDB-2012-002860 Ruby on Rails の Active Record コンポーネントにおける SQL インジェクションの脆弱性 Ruby on Rails の Active Record コンポーネントは、ActiveRecord クラスの where メソッドに対して、リクエストデータの受け渡しを適切に実装していないため、特定の SQL インジェクション攻撃を実行される脆弱性が存在します。 CVE-2012-2661 55899 CVE-2012-2661 44380 5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002860.html 2012-06-22 2016-02-10 View