Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Ruby on Rails Permissions Privileges and Access Controls Vulnerability - CVE-2013-0155 - Vulnerability Database
Ruby on Rails

Ruby on Rails Permissions Privileges and Access Controls Vulnerability - CVE-2013-0155

Medium
Reference: CVE-2013-0155
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2013-0155
Title: Ruby on Rails Permissions Privileges and Access Controls Vulnerability
Overview:

Ruby on Rails 3.0.x before 3.0.19 3.1.x before 3.1.10 and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request as demonstrated by certain quotnilquot values a related issue to CVE-2012-2660 and CVE-2012-2694.