Skip to content
OpenAdvisories
Unscored DSA-2609-1 1 CVE

rails - SQL query manipulation

Published Jan 16, 2013 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 6.0 rails 2.3.5-1.2+squeeze5

Vulnerabilities 1

  • Medium —
    CVE-2013-0155

    Active Record allows bypassing of database-query restrictions

    Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended data…

    rails activerecord Debian RubyGems