CVE-2017-17917: SQL Injection
DISPUTED SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-17917?
The severity of CVE-2017-17917 is high with a CVSS score of 8.1.
What is the affected software for CVE-2017-17917?
The affected software for CVE-2017-17917 is Ruby on Rails version 5.1.4 and earlier.
How does CVE-2017-17917 work?
CVE-2017-17917 is a SQL injection vulnerability in the 'where' method of Ruby on Rails, allowing remote attackers to execute arbitrary SQL commands via the 'id' parameter.
Is CVE-2017-17917 disputed?
Yes, there is a dispute regarding CVE-2017-17917 as the vendor states that the 'where' method is not intended for use with untrusted user input.
How can I mitigate CVE-2017-17917?
To mitigate CVE-2017-17917, it is recommended to update to a version of Ruby on Rails that is not affected by the vulnerability.