CVE-2012-2694 in Ruby on Rails

Resumen (Inglés)

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[ xyz , nil]" values, a related issue to CVE-2012-2660.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Reservar

2012-05-14

Divulgación

2012-06-22

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
61084	Ruby on Rails request.rb escalada de privilegios	264	No está definido	Arreglo oficial	CVE-2012-2694

Fuentes

• MITRE
• NVD
• CVE Details