Authlogic Information Exposure vulnerability

中危 5.0CVE-2012-6497 · GHSA-rx7j-mw4c-76g9 · Published 04/01/2013 · updated 16/06/2026

要点

CVE-2012-6497 是影响 authlogic, rails (rubyonrails) 的中危 (CVSS 5.0)漏洞。
未来 30 天内被利用的概率（EPSS）：2.7%，高于 86.1% 的漏洞。
修复：升级到 3.3.0, 3.2.10 或更高版本。

Package	Affected versions	Patched versions
authlogic RubyGems	`< 3.3.0`	`3.3.0`
rails rubyonrails	`< 3.2.10`	`3.2.10`

Description

The Authlogic gem for Ruby on Rails prior to version 3.3.0 makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in secret_token.rb in an open-source product.

NVD description

The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in secret_token.rb in an open-source product.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free