Authlogic Information Exposure vulnerability

보통 5.0CVE-2012-6497 · GHSA-rx7j-mw4c-76g9 · Published 04/01/2013 · updated 16/06/2026

요약

CVE-2012-6497은(는) authlogic, rails (rubyonrails)에 영향을 주는 보통 (CVSS 5.0) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 2.7%, 전체 취약점의 86.1%보다 높음.
조치: 3.3.0, 3.2.10 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
authlogic RubyGems	`< 3.3.0`	`3.3.0`
rails rubyonrails	`< 3.2.10`	`3.2.10`

Description

The Authlogic gem for Ruby on Rails prior to version 3.3.0 makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in secret_token.rb in an open-source product.

NVD description

The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in secret_token.rb in an open-source product.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free