CVE-2022-32224
CriticalSummary
A possible escalation to remote code execution (RCE) vulnerability exists when using YAML serialized columns in Active Record versions < 7.0.3.1, < 6.1.6.1, < 6.0.5.1, and < 5.2.8.1. An attacker who can manipulate data in the database (via means like SQL injection) could escalate to RCE.
Risk Assessment
This vulnerability poses a serious risk to organizations as it allows attackers to execute code remotely on the server, potentially leading to data loss or system takeover.
Recommendation
It is recommended to upgrade Active Record to versions 7.0.3.1 or later, 6.1.6.1 or later, 6.0.5.1 or later, and 5.2.8.1 or later to mitigate this vulnerability.
Original NVD description (English source)
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.