{"id":"CVE-2012-2695","published":"2012-06-22T14:00:00Z","modified":"2024-08-06T19:42:31Z","title":"The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not…","vendor":null,"product":null,"tier":"tail","description":{"text":"The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02947,"percentile":0.87106,"provenance":"source"},"cwes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0154.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://groups.google.com/group/rubyonrails-security/msg/aee3413fb038bf56?dmode=source&output=gplain","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":17.4,"factors":[{"name":"EPSS percentile","points":17.42}]},"affected":[{"ecosystem":"RubyGems","package":"activerecord","vulnerableRanges":[">=3.0.0.beta, <3.0.14",">=3.1.0, <3.1.6",">=3.2.0, <3.2.6","<2.3.15"],"patched":["3.0.14","3.1.6","3.2.6","2.3.15"],"from":["GHSA-76wq-xw4h-f8wj"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-0183","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-activerecord-cve-2012-2661","parents":[{"from":"CVE-2012-2661","to":"CVE-2012-2695","relation":"successor","confidence":"medium","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"…equest data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.","from":"CVE.org","in":"CVE-2012-2695"},{"kind":"text","provenance":"source","relation":"related","quote":"…e passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.","from":"CVE.org","in":"CVE-2012-2661"},{"kind":"version-step","provenance":"source","package":"RubyGems:activerecord","fromFixed":"3.0.13","toFixed":"3.0.14","daysApart":0},{"kind":"similar","provenance":"machine","score":0.78,"basis":"same package + description similarity"}]}],"children":[{"from":"CVE-2012-2695","to":"CVE-2012-6496","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:activerecord","fromFixed":"3.0.14","toFixed":"3.0.18","daysApart":196},{"kind":"same-code","provenance":"machine","files":["activerecord/lib/active_record/base.rb"],"commits":["https://github.com/rails/rails/commit/62f81f4d6b3ee40e9887ffd92ab14714bad93f18","https://github.com/rails/rails/commit/9de9b359d0d24f70f0f6c5c58a7ad8750684d456"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2011-2930","published":"2011-08-29","fixed":"3.1.0.rc5","kev":false,"link":{"from":"CVE-2011-2930","to":"CVE-2012-2695","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:activerecord","fromFixed":"2.3.13","toFixed":"2.3.15","daysApart":298}]}},{"cve":"CVE-2013-0277","published":"2013-02-13","fixed":"3.1.0","kev":false},{"cve":"CVE-2012-2661","published":"2012-06-22","fixed":"3.2.4","kev":false},{"cve":"CVE-2012-2695","published":"2012-06-22","fixed":"3.2.6","kev":false},{"cve":"CVE-2012-6496","published":"2013-01-04","fixed":"3.2.10","kev":false},{"cve":"CVE-2013-0155","published":"2013-01-13","fixed":"3.2.11","kev":false},{"cve":"CVE-2013-0276","published":"2013-02-13","fixed":"3.2.12","kev":false}],"package":"RubyGems:activerecord"}}