NVD

Id
44411  
Name
CVE-2012-2694  
Description
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "["xyz", nil]" values, a related issue to CVE-2012-2660.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2012-06-22  
Modified Date
2013-02-06  
Seq
2012-2694  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
222843 44411 CVE-2012-2694 openSUSE-SU-2012:0978  View
222844 44411 CVE-2012-2694 SUSE-SU-2012:1012  View
222845 44411 CVE-2012-2694 SUSE-SU-2012:1014  View
222846 44411 CVE-2012-2694 SUSE-SU-2012:1015  View
222847 44411 CVE-2012-2694 openSUSE-SU-2012:1066  View
222848 44411 CVE-2012-2694 RHSA-2013:0154  View
222849 44411 CVE-2012-2694 [rubyonrails-security] 20120612 Ruby on Rails Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2694)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
27154 JVNDB-2012-002861 Ruby on Rails におけるデータベースのクエリ制限を回避される脆弱性 Ruby on Rails の actionpack/lib/action_dispatch/http/request.rb は、Active Record コンポーネント と Rack インターフェースにおけるパラメータ処理の違いを適切に配慮しないため、データベースのクエリ制限を回避される、および NULL チェックを実行される脆弱性が存在します。 CVE-2012-2694 55932 CVE-2012-2694 44411 4.3 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002861.html 2012-06-22 2016-02-10 View