onyx --cves cve-2012-2695
CVE-2012-2695
- score
- <0.1
- cvss
- 7.5
- epss
- 3.0%
- published
- 2012-06-22
- kev added
- —
- first seen
Ruby on Rails < 3.0.14, 3.1.x < 3.1.6, 3.2.x < 3.2.6 contain a SQL injection caused by improper handling of nested hashes in the Active Record where method, letting remote attackers execute arbitrary SQL commands via nested query parameters, exploit requires sending crafted nested hashes.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 6
- http://rhn.redhat.com/errata/RHSA-2013-0154.html
- https://groups.google.com/group/rubyonrails-security/msg/aee3413fb038bf56?dmode=source&output=gplain
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
- http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html