Action Pack contains database-query restrictions bypass

🗓️ 24 Oct 2017 00:00:00Reported by https://gitlab.com/gitlab-org/security-products/gemnasium-dbType

Vulnerability in actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 allows remote attackers to bypass database-query restrictions via crafted requests

Reporter	Title	Published	Views	Family All 82
FreeBSD	rubygem-activerecord -- multiple vulnerabilities	31 May 201200:00	–	freebsd
ATTACKERKB	CVE-2013-0155	13 Jan 201322:55	–	attackerkb
CVE	CVE-2012-2660	22 Jun 201214:00	–	cve
Cvelist	CVE-2012-2660	22 Jun 201214:00	–	cvelist
EUVD	EUVD-2017-0242	13 Jan 201322:00	–	euvd
EUVD	EUVD-2017-0251	7 Oct 202500:30	–	euvd
Fedora	[SECURITY] Fedora 16 Update: rubygem-actionpack-3.0.10-10.fc16	23 Jan 201301:34	–	fedora
Fedora	[SECURITY] Fedora 16 Update: rubygem-actionpack-3.0.10-6.fc16	15 Jun 201200:29	–	fedora
Fedora	[SECURITY] Fedora 17 Update: rubygem-actionpack-3.0.11-4.fc17	15 Jun 201200:24	–	fedora
Fedora	[SECURITY] Fedora 16 Update: rubygem-actionpack-3.0.10-7.fc16	30 Jun 201208:26	–	fedora

Vulners

Node

gem actionpackRange3.0.0.beta≥

gem actionpackRange<3.0.13

gem actionpackRange3.1.0≥

gem actionpackRange<3.1.5

gem actionpackRange3.2.0≥

gem actionpackRange<3.2.4

gem actionpackRange<2.3.16

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2012-2660
github	www.github.com/advisories/GHSA-hgpp-pp89-4fgf
github	www.github.com/rails/rails/commit/61eed87ce32caf534bf1f52dd8134097b4ad9e1b
github	www.github.com/rails/rails
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-2660.yml
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2012-2660.yml
groups	www.groups.google.com/g/rubyonrails-security/c/8SA-M3as7A8/m/Mr9fi9X4kNgJ
groups	www.groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32

24 Oct 2017 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 26.4

EPSS0.046