CVE-2016-6317
HighSummary
Ruby on Rails 4.2.x versions before 4.2.7.1 improperly handle parameter differences between the Active Record component and the JSON implementation, allowing remote attackers to bypass intended database-query restrictions.
Risk Assessment
Attackers can exploit this vulnerability to perform unauthorized database operations, potentially leading to data disclosure or system integrity violations.
Recommendation
It is recommended to upgrade Ruby on Rails to version 4.2.7.1 or later to mitigate this vulnerability.
Other vulnerabilities in Ruby on Rails
See all- CVE-2017-17920High
SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter.
- CVE-2017-17919High
SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter.
- CVE-2017-17917High
SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter.
- CVE-2017-17916High
SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter.
Original NVD description (English source)
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.