CVE-2016-6317
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.90%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 3.90% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284, CWE-476
- Affected
- rubyonrails/rails
- Source
- secalert@redhat.com
References
- http://rhn.redhat.com/errata/RHSA-2016-1855.html
- http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/Release Notes
- http://www.openwall.com/lists/oss-security/2016/08/11/4Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/92434
- https://groups.google.com/forum/#%21topic/ruby-security-ann/WccgKSKiPZA
- http://rhn.redhat.com/errata/RHSA-2016-1855.html
- http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/Release Notes
- http://www.openwall.com/lists/oss-security/2016/08/11/4Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/92434
- https://groups.google.com/forum/#%21topic/ruby-security-ann/WccgKSKiPZA
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.