vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2012-2661

N/A
Published: June 22, 2012 at 02:00 PM UTC
Updated: June 16, 2026 at 11:41 PM UTC
2 products affected across 1 vendorRailsRubyonrails

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 4%

Description

The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.

References (5)

Vendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
Vendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
Vendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
http://rhn.redhat.com/errata/RHSA-2013-0154.html
Mailing Listx_refsource_MLISTExploit
Source: [email protected]
https://groups.google.com/group/rubyonrails-security/msg/fc2da6c627fc92df?dmode=source&output=gplain

CVSS

5MEDIUM[email protected]
Confidentiality
PARTIAL
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-89

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card