CVE-2014-3514 in Ruby on Rails
Sumário (Inglês)
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
Reservar
14/05/2014
Divulgação
20/08/2014
Inscrições
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidade | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 67377 | Ruby on Rails ActiveRecord create_with Elevação de Privilégios | 264 | Não provado | Correção oficial | CVE-2014-3514 |