CVE-2014-3514 in Ruby on Rails
Summary
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
05/14/2014
Disclosure
08/20/2014
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 67377 | Ruby on Rails ActiveRecord create_with access control | 264 | Unproven | Official fix | CVE-2014-3514 |