| Package | Affected versions | Patched versions |
|---|---|---|
| activerecord | ≥ 4.0.0, < 4.0.9≥ 4.1.0, < 4.1.5 | 4.0.94.1.5 |
| rails | = 4.0.0= 4.0.1= 4.0.2= 4.0.3= 4.0.4= 4.0.5= 4.0.6= 4.0.7= 4.0.8= 4.1.0= 4.1.1= 4.1.2= 4.1.3= 4.1.4 |
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free