CVE-2012-2694 in Ruby on Rails
Summary
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[ xyz , nil]" values, a related issue to CVE-2012-2660.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Reservation
05/14/2012
Disclosure
06/22/2012
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 61084 | Ruby on Rails request.rb access control | 264 | Not defined | Official fix | CVE-2012-2694 |