CVE-2016-6317
Last modified
CVE-2016-6317 is a vulnerability of currently unknown severity. Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.. EPSS estimates a 3.90% chance of exploitation in the next 30 days.
Description
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Rubyonrails | Rails | 4.2.0 |
| Rubyonrails | Rails | 4.2.1 |
| Rubyonrails | Rails | 4.2.2 |
| Rubyonrails | Rails | 4.2.3 |
| Rubyonrails | Rails | 4.2.4 |
| Rubyonrails | Rails | 4.2.5 |
| Rubyonrails | Rails | 4.2.5.1 |
| Rubyonrails | Rails | 4.2.5.2 |
| Rubyonrails | Rails | 4.2.6 |
| Rubyonrails | Rails | 4.2.7 |
References
- http://www.openwall.com/lists/oss-security/2016/08/11/4Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/08/11/4Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-6317?
How severe is CVE-2016-6317?
How do I fix CVE-2016-6317?
Are you affected by CVE-2016-6317?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST