Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Ruby on Rails Permissions Privileges and Access Controls Vulnerability - CVE-2012-2660 - Vulnerability Database
Ruby on Rails

Ruby on Rails Permissions Privileges and Access Controls Vulnerability - CVE-2012-2660

Medium
Reference: CVE-2012-2660
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2012-2660
Title: Ruby on Rails Permissions Privileges and Access Controls Vulnerability
Overview:

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13 3.1.x before 3.1.5 and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request as demonstrated by certain quotnilquot values a related issue to CVE-2012-2694.