CVE-2014-3483 in Ruby on Rails
Summary
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
Reservation
05/14/2014
Disclosure
07/07/2014
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 66979 | Ruby on Rails range Query quoting.rb sql injection | 89 | High | Official fix | CVE-2014-3483 |