5
CVSSv2

CVE-2016-6317

Published: 07/09/2016 Updated: 08/08/2019
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Summary

Action Record in Ruby on Rails 4.2.x prior to 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote malicious users to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.

Affected Products

Vendor Product Versions
RubyonrailsRails4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.5.1, 4.2.5.2, 4.2.6, 4.2.7

Vendor Advisories

Debian Bug report logs - #834154 rails: CVE-2016-6317: unsafe query generation in Active Record Package: src:rails; Maintainer for src:rails is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 12 Aug 2016 15:15:11 UTC ...
Debian Bug report logs - #834155 rails: CVE-2016-6316: Possible XSS Vulnerability in Action View Package: src:rails; Maintainer for src:rails is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 12 Aug 2016 15:21:02 UT ...
A flaw was found in the way Active Record handled certain special values in dynamic finders and relations If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application ...

Github Repositories

This repo has a dependency which is associated with this CVE-2016-6317 Action Record in Ruby on Rails 42x before 4271 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE claus