{"id":"CVE-2012-6496","published":"2013-01-04T02:00:00Z","modified":"2024-08-06T21:28:39Z","title":"SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and…","vendor":null,"product":null,"tier":"tail","description":{"text":"SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04582,"percentile":0.91601,"provenance":"source"},"cwes":[],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=889649","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0155.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/","tags":["x_refsource_MISC"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0220.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://security.gentoo.org/glsa/glsa-201401-22.xml","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0154.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source&output=gplain","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.securityfocus.com/bid/57084","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0544.html","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":18.3,"factors":[{"name":"EPSS percentile","points":18.32}]},"affected":[{"ecosystem":"RubyGems","package":"activerecord","vulnerableRanges":[">=3.0.0.beta, <3.0.18",">=3.1.0, <3.1.9",">=3.2.0, <3.2.10","<2.3.15"],"patched":["3.0.18","3.1.9","3.2.10","2.3.15"],"from":["GHSA-gh2w-j7cx-2664"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-0238","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-activerecord-cve-2012-2661","parents":[{"from":"CVE-2012-2695","to":"CVE-2012-6496","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:activerecord","fromFixed":"3.0.14","toFixed":"3.0.18","daysApart":196},{"kind":"same-code","provenance":"machine","files":["activerecord/lib/active_record/base.rb"],"commits":["https://github.com/rails/rails/commit/62f81f4d6b3ee40e9887ffd92ab14714bad93f18","https://github.com/rails/rails/commit/9de9b359d0d24f70f0f6c5c58a7ad8750684d456"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2011-2930","published":"2011-08-29","fixed":"3.1.0.rc5","kev":false,"link":{"from":"CVE-2011-2930","to":"CVE-2012-6496","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:activerecord","fromFixed":"2.3.13","toFixed":"2.3.15","daysApart":494}]}},{"cve":"CVE-2013-0277","published":"2013-02-13","fixed":"3.1.0","kev":false,"link":{"from":"CVE-2012-6496","to":"CVE-2013-0277","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:activerecord","fromFixed":"2.3.15","toFixed":"2.3.17","daysApart":40}]}},{"cve":"CVE-2012-2661","published":"2012-06-22","fixed":"3.2.4","kev":false},{"cve":"CVE-2012-2695","published":"2012-06-22","fixed":"3.2.6","kev":false},{"cve":"CVE-2012-6496","published":"2013-01-04","fixed":"3.2.10","kev":false},{"cve":"CVE-2013-0155","published":"2013-01-13","fixed":"3.2.11","kev":false,"link":{"from":"CVE-2012-6496","to":"CVE-2013-0155","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:activerecord","fromFixed":"3.0.18","toFixed":"3.0.19","daysApart":9}]}},{"cve":"CVE-2013-0276","published":"2013-02-13","fixed":"3.2.12","kev":false,"link":{"from":"CVE-2012-6496","to":"CVE-2013-0276","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:activerecord","fromFixed":"2.3.15","toFixed":"2.3.17","daysApart":40}]}},{"cve":"CVE-2013-1854","published":"2013-03-19","fixed":"3.2.13","kev":false}],"package":"RubyGems:activerecord"}}