activerecord vulnerable to SQL Injection

HIGH 7.5CVE-2011-0448 · GHSA-jmm9-2p29-vh2w · Published 21/02/2011 · updated 16/06/2026

Package	Affected versions	Patched versions
activerecord RubyGems	`≥ 3.0.0, < 3.0.4`	`3.0.4`
rails rubyonrails	`= 3.0.0= 3.0.1= 3.0.2= 3.0.3= 3.0.4`	No fix yet

Description

Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2011-0448 · ADVISORY
rails/rails commit 354da43 · WEB
rails/rails · PACKAGE
rubysec/ruby-advisory-db · WEB
web.archive.org/web/20201220214809/http://securitytracker.com/id · WEB
groups.google.com/group/rubyonrails-security/msg/4e19864cf6ad40ad · WEB
lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html · WEB
weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4 · WEB
secunia.com/advisories/43278 · Vendor Advisory
securitytracker.com/id
vupen.com/english/advisories/2011/0877

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free