CVE-2012-2660 in Ruby on Rails
Summary
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
05/14/2012
Disclosure
06/22/2012
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 61083 | Ruby on Rails request.rb access control | 264 | Not defined | Official fix | CVE-2012-2660 |