Lucene search
HistoryJul 07, 2014 - 11:01 a.m.
CVE-2014-3483
CVSS2
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
8.2
Confidence
Low
EPSS
0.009
Percentile
82.6%
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
Affected configurations
Node
rubyonrailsrailsMatch4.0.0-
ORrubyonrailsrailsMatch4.0.0beta
ORrubyonrailsrailsMatch4.0.0rc1
ORrubyonrailsrailsMatch4.0.0rc2
ORrubyonrailsrailsMatch4.0.1-
ORrubyonrailsrailsMatch4.0.1rc1
ORrubyonrailsrailsMatch4.0.1rc2
ORrubyonrailsrailsMatch4.0.1rc3
ORrubyonrailsrailsMatch4.0.1rc4
ORrubyonrailsrailsMatch4.0.2
ORrubyonrailsrailsMatch4.0.3
ORrubyonrailsrailsMatch4.0.4
ORrubyonrailsrailsMatch4.0.5
ORrubyonrailsrailsMatch4.0.6
ORrubyonrailsrailsMatch4.0.6rc1
ORrubyonrailsrailsMatch4.0.6rc2
ORrubyonrailsrailsMatch4.0.6rc3
ORrubyonrailsrailsMatch4.1.0-
ORrubyonrailsrailsMatch4.1.0beta1
ORrubyonrailsrailsMatch4.1.1
ORrubyonrailsrailsMatch4.1.2
ORrubyonrailsrailsMatch4.1.2rc1
ORrubyonrailsrailsMatch4.1.2rc2
ORrubyonrailsrailsMatch4.1.2rc3
References
Related
redhat
redhat
(RHSA-2014:0877) Moderate: ror40-rubygem-activerecord security update
2014-07-14 00:00:00
prion
prion
Sql injection
2014-07-07 11:01:00
osv
osv
Active Record contains SQL Injection via improper range quoting
2017-10-24 18:33:36
rubygems
rubygems
veracode
veracode
SQL Command Injection By Leveraging Improper Range Quoting
2019-01-15 08:56:06
cve
cve
CVE-2014-3483
2014-07-07 11:01:30
nessus
nessus
RHEL 6 / 7 : ror40-rubygem-activerecord (RHSA-2014:0877)
2024-04-27 00:00:00
Fedora 20 : rubygem-activerecord-4.0.0-4.fc20 (2014-8065)
2014-08-23 00:00:00
Debian DSA-2982-1 : ruby-activerecord-3.2 - security update
2014-07-21 00:00:00
debiancve
debiancve
CVE-2014-3483
2014-07-07 11:01:30
github
github
Active Record contains SQL Injection via improper range quoting
2017-10-24 18:33:36
cvelist
cvelist
CVE-2014-3483
2014-07-07 10:00:00
hackerone
hackerone
gitlab
gitlab
SQL Injection Vulnerabilities Affecting PostgreSQL
2014-07-07 00:00:00
ubuntucve
ubuntucve
CVE-2014-3483
2014-07-07 00:00:00
openvas
openvas
Fedora Update for rubygem-activerecord FEDORA-2014-8065
2014-08-23 00:00:00
Mageia: Security Advisory (MGASA-2014-0303)
2022-01-28 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: rubygem-activerecord-4.0.0-4.fc20
2014-08-23 02:01:38
[SECURITY] Fedora 20 Update: rubygem-activerecord-4.0.0-5.fc20
2014-09-26 09:01:18
mageia
mageia
Updated ruby-actionpack packages fix security issues
2014-07-26 17:09:43
debian
debian
[SECURITY] [DSA 2982-1] ruby-activerecord-3.2 security update
2014-07-19 10:09:34
securityvulns
securityvulns
[SECURITY] [DSA 2982-1] ruby-activerecord-3.2 security update
2014-10-16 00:00:00
CVSS2
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
8.2
Confidence
Low
EPSS
0.009
Percentile
82.6%
Related for NVD:CVE-2014-3483