7.5
CVSSv2

CVE-2014-3483

Published: 07/07/2014 Updated: 08/08/2019
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x prior to 4.0.7 and 4.1.x prior to 4.1.3 allows remote malicious users to execute arbitrary SQL commands by leveraging improper range quoting.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

rubyonrails rails 4.0.5

rubyonrails rails 4.0.1

rubyonrails rails 4.0.6

rubyonrails rails 4.1.0

rubyonrails rails 4.0.4

rubyonrails rails 4.0.3

rubyonrails rails 4.0.2

rubyonrails rails 4.1.2

rubyonrails rails 4.1.1

rubyonrails rails 4.0.0

Vendor Advisories

Sean Griffin discovered two vulnerabilities in the PostgreSQL adapter for Active Record which could lead to SQL injection For the stable distribution (wheezy), these problems have been fixed in version 326-5+deb7u1 Debian provides two variants of Ruby on Rails in Wheezy (23 and 32) Support for the 23 variants had to be ceased at this point ...
It was discovered that Active Record did not properly quote values of the range type attributes when using the PostgreSQL database adapter A remote attacker could possibly use this flaw to conduct an SQL injection attack against applications using Active Record ...