Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Ruby on Rails Permissions Privileges and Access Controls Vulnerability - CVE-2012-2694 - Vulnerability Database
Ruby on Rails

Ruby on Rails Permissions Privileges and Access Controls Vulnerability - CVE-2012-2694

Medium
Reference: CVE-2012-2694
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2012-2694
Title: Ruby on Rails Permissions Privileges and Access Controls Vulnerability
Overview:

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14 3.1.x before 3.1.6 and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request as demonstrated by certain quot39xyz39 nilquot values a related issue to CVE-2012-2660.