CVE-2014-3483 in Ruby on Rails
Сводка (Английский)
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
Резервировать
14.05.2014
Раскрытие
07.07.2014
Записи
VulDB provides additional information and datapoints for this CVE:
| ИД | Уязвимость | CWE | Экс | Кон | CVE |
|---|---|---|---|---|---|
| 66979 | Ruby on Rails range Query quoting.rb SQL-инъекция | 89 | Высокий | Официальное исправление | CVE-2014-3483 |