CVE-2011-0448: SQL Injection
Published Feb 21, 2011
·Updated
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
Affected Software
14 affected componentsFixes available
rubygems/activerecord>=3.0.0<3.0.4
3.0.4
rubyonrails Rails=3.0.0-beta
rubyonrails Rails=3.0.0-beta2
rubyonrails Rails=3.0.0-beta3
rubyonrails Rails=3.0.0-beta4
rubyonrails Rails=3.0.0-rc
rubyonrails Rails=3.0.0-rc2
rubyonrails Rails=3.0.1-pre
rubyonrails Rails=3.0.2-pre
rubyonrails Rails=3.0.0
rubyonrails Rails=3.0.1
rubyonrails Rails=3.0.2
rubyonrails Rails=3.0.3
rubyonrails Rails=3.0.4-rc1
Remediation
Event History
Feb 21, 2011
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Oct 24, 2017
Advisory Published
06:33 PM
Frequently Asked Questions
1
What is the severity of CVE-2011-0448?
CVE-2011-0448 is considered a high severity vulnerability due to its potential to enable SQL injection attacks.
2
How do I fix CVE-2011-0448?
Updating to Ruby on Rails version 3.0.4 or higher resolves the issue related to CVE-2011-0448.
3
Which versions of Ruby on Rails are affected by CVE-2011-0448?
CVE-2011-0448 affects Ruby on Rails versions 3.0.0 through 3.0.3.
4
What type of vulnerability is CVE-2011-0448?
CVE-2011-0448 is categorized as an SQL injection vulnerability.
5
Who can exploit CVE-2011-0448?
Remote attackers can exploit CVE-2011-0448 by passing non-numeric arguments to the limit function.