CVE-2017-17920: SQL Injection
Published Dec 29, 2017
·Updated
DISPUTED SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input.
Affected Software
1 affected component
rubyonrails ruby on Rails<=5.1.4
Event History
Dec 29, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Disputed
04:29 PM
Frequently Asked Questions
1
What is the vulnerability ID for this SQL injection vulnerability?
The vulnerability ID for this SQL injection vulnerability is CVE-2017-17920.
2
What is the severity of CVE-2017-17920?
The severity of CVE-2017-17920 is high with a severity value of 8.1.
3
What is the affected software for CVE-2017-17920?
The affected software is Ruby on Rails version 5.1.4 and earlier.
4
How can remote attackers exploit CVE-2017-17920?
Remote attackers can exploit CVE-2017-17920 by executing arbitrary SQL commands through the 'name' parameter in the 'reorder' method.
5
Is there a disputed status for CVE-2017-17920?
Yes, there is a disputed status for CVE-2017-17920.