CVE-2011-2930

2011-08-2900:00:00

ubuntu.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

71.9%

JSON

Multiple SQL injection vulnerabilities in the quote_table_name method in
the ActiveRecord adapters in
activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before
2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote
attackers to execute arbitrary SQL commands via a crafted column name.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/rails/+bug/842667>

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchrails< 2.2.3-2ubuntu0.1UNKNOWN
ubuntu10.10noarchrails< 2.3.5-1.1ubuntu0.1UNKNOWN
ubuntu11.04noarchrails< 2.3.5-1.2ubuntu1.1UNKNOWN