SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| activerecord(RubyGems) | 3.0.0.beta | 3.0.18 | N/A |
| activerecord(RubyGems) | 3.1.0 | 3.1.9 | N/A |
| activerecord(RubyGems) | 3.2.0 | 3.2.10 | N/A |
| activerecord(RubyGems) | 0 | 2.3.15 | N/A |
CVSS Metrics
