CVE-2013-6417

score

<0.1

cvss

6.4

epss

2.4%

published

2013-12-07

kev added

—

first seen

2026-10-21

Ruby on Rails before 3.2.16 and 4.0.2 contains a parameter handling bypass caused by differences between Active Record and JSON implementations, letting remote attackers bypass database query restrictions via crafted requests, exploit requires crafted request leveraging third-party or custom Rack middleware.