Ruby on Rails Permissions Privileges and Access Controls Vulnerability - CVE-2013-6417 - Vulnerability Database

Ruby on Rails Permissions Privileges and Access Controls Vulnerability - CVE-2013-6417

Medium

Reference: CVE-2013-6417

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2013-6417

Title: Ruby on Rails Permissions Privileges and Access Controls Vulnerability

Overview:

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.