Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Ruby on Rails Improper Access Control Vulnerability - CVE-2016-6317 - Vulnerability Database
Ruby on Rails

Ruby on Rails Improper Access Control Vulnerability - CVE-2016-6317

High
Reference: CVE-2016-6317
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2016-6317
Title: Ruby on Rails Improper Access Control Vulnerability
Overview:

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request as demonstrated by certain quotnilquot values a related issue to CVE-2012-2660 CVE-2012-2694 and CVE-2013-0155.