CVE-2012-6496: SQL Injection

Q: What is the severity of CVE-2012-6496?

CVE-2012-6496 has a medium severity rating as it allows remote attackers to execute arbitrary SQL commands.

Q: How do I fix CVE-2012-6496?

To mitigate CVE-2012-6496, upgrade the Active Record component to version 2.3.15, 3.0.18, 3.1.9, or 3.2.10 or later.

Q: Which versions of Ruby on Rails are affected by CVE-2012-6496?

CVE-2012-6496 affects Ruby on Rails versions before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10.

Q: What type of vulnerability is CVE-2012-6496?

CVE-2012-6496 is an SQL injection vulnerability allowing attackers to manipulate SQL queries.

Q: Can CVE-2012-6496 impact my application?

Yes, if your application utilizes the affected versions of Active Record, it may be vulnerable to SQL injection attacks.

Published Jan 4, 2013

Updated

SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain findby method calls.

Other sources

SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain findby method calls.

Affected Software

88 affected componentsFixes available

rubygems/activerecord<2.3.15

2.3.15

rubygems/activerecord>=3.0.0.beta<3.0.18

3.0.18

rubygems/activerecord>=3.2.0<3.2.10

3.2.10

rubygems/activerecord>=3.1.0<3.1.9

3.1.9

rubyonrails Rails=3.1.0

rubyonrails Rails=3.1.0-beta1

rubyonrails Rails=3.1.0-rc1

rubyonrails Rails=3.1.0-rc2

rubyonrails Rails=3.1.0-rc3

rubyonrails Rails=3.1.0-rc4

rubyonrails Rails=3.1.0-rc5

rubyonrails Rails=3.1.0-rc6

rubyonrails Rails=3.1.0-rc7

rubyonrails Rails=3.1.0-rc8

rubyonrails Rails=3.1.1

rubyonrails Rails=3.1.1-rc1

rubyonrails Rails=3.1.1-rc2

rubyonrails Rails=3.1.1-rc3

rubyonrails Rails=3.1.2

rubyonrails Rails=3.1.2-rc1

rubyonrails Rails=3.1.2-rc2

rubyonrails Rails=3.1.3

rubyonrails Rails=3.1.4

rubyonrails Rails=3.1.4-rc1

rubyonrails Rails=3.1.5

rubyonrails Rails=3.1.5-rc1

rubyonrails Rails=3.1.6

rubyonrails Rails=3.1.7

rubyonrails Rails=3.1.8

rubyonrails Rails=3.0.0

rubyonrails Rails=3.0.0-beta

rubyonrails Rails=3.0.0-beta2

rubyonrails Rails=3.0.0-beta3

rubyonrails Rails=3.0.0-beta4

rubyonrails Rails=3.0.0-rc

rubyonrails Rails=3.0.0-rc2

rubyonrails Rails=3.0.1

rubyonrails Rails=3.0.1-pre

rubyonrails Rails=3.0.2

rubyonrails Rails=3.0.2-pre

rubyonrails Rails=3.0.3

rubyonrails Rails=3.0.4-rc1

rubyonrails Rails=3.0.5

rubyonrails Rails=3.0.5-rc1

rubyonrails Rails=3.0.6

rubyonrails Rails=3.0.6-rc1

rubyonrails Rails=3.0.6-rc2

rubyonrails Rails=3.0.7

rubyonrails Rails=3.0.7-rc1

rubyonrails Rails=3.0.7-rc2

rubyonrails Rails=3.0.8

rubyonrails Rails=3.0.8-rc1

rubyonrails Rails=3.0.8-rc2

rubyonrails Rails=3.0.8-rc3

rubyonrails Rails=3.0.8-rc4

rubyonrails Rails=3.0.9

rubyonrails Rails=3.0.9-rc1

rubyonrails Rails=3.0.9-rc2

rubyonrails Rails=3.0.9-rc3

rubyonrails Rails=3.0.9-rc4

rubyonrails Rails=3.0.9-rc5

rubyonrails Rails=3.0.10

rubyonrails Rails=3.0.10-rc1

rubyonrails Rails=3.0.11

rubyonrails Rails=3.0.12

rubyonrails Rails=3.0.12-rc1

rubyonrails Rails=3.0.13

rubyonrails Rails=3.0.13-rc1

rubyonrails Rails=3.0.14

rubyonrails Rails=3.0.16

rubyonrails ruby on Rails<=3.0.17

rubyonrails ruby on Rails=3.0.4

rubyonrails Rails=3.2.0

rubyonrails Rails=3.2.0-rc1

rubyonrails Rails=3.2.0-rc2

rubyonrails Rails=3.2.1

rubyonrails Rails=3.2.2

rubyonrails Rails=3.2.2-rc1

rubyonrails Rails=3.2.3

rubyonrails Rails=3.2.3-rc1

rubyonrails Rails=3.2.3-rc2

rubyonrails Rails=3.2.4

rubyonrails Rails=3.2.4-rc1

rubyonrails Rails=3.2.5

rubyonrails Rails=3.2.6

rubyonrails Rails=3.2.7

rubyonrails Rails=3.2.8

rubyonrails Rails=3.2.9

Remediation

Patch Available

https://bugzilla.redhat.com/show_bug.cgi?id=889649

Event History

Jan 4, 2013

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Oct 24, 2017

Advisory Published

via GitHub·06:33 PM

Frequently Asked Questions

What is the severity of CVE-2012-6496?