CVE-2012-2660 in Ruby on Rails

Resumen (Inglés)

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Reservar

2012-05-14

Divulgación

2012-06-22

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
61083	Ruby on Rails request.rb escalada de privilegios	264	No está definido	Arreglo oficial	CVE-2012-2660

Fuentes

• MITRE
• NVD
• CVE Details