CVE-2011-0448
published 2011-02-21CVE-2011-0448: Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to…
PriorityP336high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
2.17%
80.3th percentile
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| activerecord_project | activerecord | >= 3.0.0 < 3.0.4 | 3.0.4 |
| debian | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_debian7.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
activerecord vulnerable to SQL Injection
ghsa·2017-10-24
CVE-2011-0448 [HIGH] CWE-89 activerecord vulnerable to SQL Injection
activerecord vulnerable to SQL Injection
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
OSV
activerecord vulnerable to SQL Injection
osv·2017-10-24
CVE-2011-0448 [HIGH] activerecord vulnerable to SQL Injection
activerecord vulnerable to SQL Injection
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
Debian
CVE-2011-0448: rails - Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit fun...
vendor_debian·2011·CVSS 7.5
CVE-2011-0448 [HIGH] CVE-2011-0448: rails - Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit fun...
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
http://groups.google.com/group/rubyonrails-security/msg/4e19864cf6ad40ad?dmode=source&output=gplainhttp://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.htmlhttp://secunia.com/advisories/43278http://securitytracker.com/id?1025063http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4http://www.vupen.com/english/advisories/2011/0877https://github.com/rails/rails/commit/354da43ab0a10b3b7b3f9cb0619aa562c3be8474http://groups.google.com/group/rubyonrails-security/msg/4e19864cf6ad40ad?dmode=source&output=gplainhttp://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.htmlhttp://secunia.com/advisories/43278http://securitytracker.com/id?1025063http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4http://www.vupen.com/english/advisories/2011/0877https://github.com/rails/rails/commit/354da43ab0a10b3b7b3f9cb0619aa562c3be8474
2011-02-21
Published