CVE-2011-2930 activerecord vulnerable to SQL Injection
HighCVSS 7.5
EPSS 2.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems activerecord(RubyGems) | >= 2.0.0, < 2.3.13 | 2.3.13 |
| rubygems activerecord(RubyGems) | = 2.0.0 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.0.1 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.0.2 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.0.4 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.0.5 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.1.0 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.1.1 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.1.2 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.2.2 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.2.3 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.3.10 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.3.11 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.3.12 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.3.2 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.3.3 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.3.4 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.3.5 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.3.6 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.3.7 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.3.8 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.3.8.pre1 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.3.9 | No fix listed |
| rubygems activerecord(RubyGems) | = 2.3.9.pre | No fix listed |
| rubygems activerecord(RubyGems) | >= 3.0.0.beta, < 3.0.10 | 3.0.10 |
Show 98 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems activerecord(RubyGems) | = 3.0.0 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.0.beta | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.0.beta2 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.0.beta3 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.0.beta4 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.0.rc | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.0.rc2 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.1 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.10.rc1 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.2 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.3 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.4 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.4.rc1 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.5 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.5.rc1 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.6 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.6.rc1 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.6.rc2 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.7 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.7.rc1 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.7.rc2 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.8 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.8.rc1 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.8.rc2 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.8.rc4 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.9 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.9.rc1 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.9.rc3 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.9.rc4 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.0.9.rc5 | No fix listed |
| rubygems activerecord(RubyGems) | >= 3.1.0.beta1, < 3.1.0.rc5 | 3.1.0.rc5 |
| rubygems activerecord(RubyGems) | = 3.1.0.beta1 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.1.0.rc1 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.1.0.rc2 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.1.0.rc3 | No fix listed |
| rubygems activerecord(RubyGems) | = 3.1.0.rc4 | No fix listed |
| debian/rails(Debian:12) | < 2.3.14 | 2.3.14 |
| debian/rails(Debian:13) | < 2.3.14 | 2.3.14 |
| debian/rails(Debian:14) | < 2.3.14 | 2.3.14 |
| rubyonrails rails | = 2.0.0 | No fix listed |
| rubyonrails rails | = 2.0.0-rc1 | No fix listed |
| rubyonrails rails | = 2.0.0-rc2 | No fix listed |
| rubyonrails rails | = 2.0.1 | No fix listed |
| rubyonrails rails | = 2.0.2 | No fix listed |
| rubyonrails rails | = 2.0.4 | No fix listed |
| rubyonrails rails | = 2.1.0 | No fix listed |
| rubyonrails rails | = 2.1.1 | No fix listed |
| rubyonrails rails | = 2.1.2 | No fix listed |
| rubyonrails rails | = 2.2.0 | No fix listed |
| rubyonrails rails | = 2.2.1 | No fix listed |
| rubyonrails rails | = 2.2.2 | No fix listed |
| rubyonrails rails | = 2.3.2 | No fix listed |
| rubyonrails rails | = 2.3.3 | No fix listed |
| rubyonrails rails | = 2.3.4 | No fix listed |
| rubyonrails rails | = 2.3.9 | No fix listed |
| rubyonrails rails | = 2.3.10 | No fix listed |
| rubyonrails rails | = 2.3.11 | No fix listed |
| rubyonrails rails | = 2.3.12 | No fix listed |
| rubyonrails rails | = 3.0.0 | No fix listed |
| rubyonrails rails | = 3.0.0-beta | No fix listed |
| rubyonrails rails | = 3.0.0-beta2 | No fix listed |
| rubyonrails rails | = 3.0.0-beta3 | No fix listed |
| rubyonrails rails | = 3.0.0-beta4 | No fix listed |
| rubyonrails rails | = 3.0.0-rc | No fix listed |
| rubyonrails rails | = 3.0.0-rc2 | No fix listed |
| rubyonrails rails | = 3.0.1 | No fix listed |
| rubyonrails rails | = 3.0.1-pre | No fix listed |
| rubyonrails rails | = 3.0.2 | No fix listed |
| rubyonrails rails | = 3.0.2-pre | No fix listed |
| rubyonrails rails | = 3.0.3 | No fix listed |
| rubyonrails rails | = 3.0.4-rc1 | No fix listed |
| rubyonrails rails | = 3.0.5 | No fix listed |
| rubyonrails rails | = 3.0.5-rc1 | No fix listed |
| rubyonrails rails | = 3.0.6 | No fix listed |
| rubyonrails rails | = 3.0.6-rc1 | No fix listed |
| rubyonrails rails | = 3.0.6-rc2 | No fix listed |
| rubyonrails rails | = 3.0.7 | No fix listed |
| rubyonrails rails | = 3.0.7-rc1 | No fix listed |
| rubyonrails rails | = 3.0.7-rc2 | No fix listed |
| rubyonrails rails | = 3.0.8 | No fix listed |
| rubyonrails rails | = 3.0.8-rc1 | No fix listed |
| rubyonrails rails | = 3.0.8-rc2 | No fix listed |
| rubyonrails rails | = 3.0.8-rc3 | No fix listed |
| rubyonrails rails | = 3.0.8-rc4 | No fix listed |
| rubyonrails rails | = 3.0.9 | No fix listed |
| rubyonrails rails | = 3.0.9-rc1 | No fix listed |
| rubyonrails rails | = 3.0.9-rc2 | No fix listed |
| rubyonrails rails | = 3.0.9-rc3 | No fix listed |
| rubyonrails rails | = 3.0.9-rc4 | No fix listed |
| rubyonrails rails | = 3.0.9-rc5 | No fix listed |
| rubyonrails rails | = 3.0.10-rc1 | No fix listed |
| rubyonrails rails | = 3.1.0 | No fix listed |
| rubyonrails rails | = 3.1.0-beta1 | No fix listed |
| rubyonrails rails | = 3.1.0-rc1 | No fix listed |
| rubyonrails rails | = 3.1.0-rc2 | No fix listed |
| rubyonrails rails | = 3.1.0-rc3 | No fix listed |
| rubyonrails rails | = 3.1.0-rc4 | No fix listed |
| rubyonrails ruby on rails | = 3.0.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugzilla.redhat.com patch
- github.com product
- github.com exploit
- [rubyonrails-security] 20110816 SQL Injection Vulnerability in quote_table_name mailing-list patch
- FEDORA-2011-11386 vendor-advisory
- weblog.rubyonrails.org patch
- DSA-2301 vendor-advisory
- [oss-security] 20110817 CVE request: ruby on rails flaws (4) mailing-list patch
- [oss-security] 20110819 Re: CVE request: ruby on rails flaws (4) mailing-list patch
- [oss-security] 20110820 Re: CVE request: ruby on rails flaws (4) mailing-list patch
- [oss-security] 20110822 Re: CVE request: ruby on rails flaws (4) mailing-list patch
- [oss-security] 20110822 Re: CVE request: ruby on rails flaws (4) mailing-list
- [oss-security] 20110822 Re: CVE request: ruby on rails flaws (4) mailing-list patch
- Debian Security Tracker CVE-2011-2930 vendor-advisory
- github.com