CVE-2012-2660

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-05-31T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2694."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2012-09-07T09:00:00.000Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "SUSE-SU-2012:1015", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html"}, {"name": "SUSE-SU-2012:1012", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"}, {"name": "openSUSE-SU-2012:0978", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"}, {"name": "SUSE-SU-2012:1014", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"}, {"name": "openSUSE-SU-2012:1066", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"}, {"name": "[rubyonrails-security] 20120531 Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2660)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain"}, {"name": "RHSA-2013:0154", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2012-2660", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2694."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "SUSE-SU-2012:1015", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html"}, {"name": "SUSE-SU-2012:1012", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"}, {"name": "openSUSE-SU-2012:0978", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"}, {"name": "SUSE-SU-2012:1014", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"}, {"name": "openSUSE-SU-2012:1066", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"}, {"name": "[rubyonrails-security] 20120531 Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2660)", "refsource": "MLIST", "url": "https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain"}, {"name": "RHSA-2013:0154", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T19:42:31.885Z"}, "title": "CVE Program Container", "references": [{"name": "SUSE-SU-2012:1015", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html"}, {"name": "SUSE-SU-2012:1012", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"}, {"name": "openSUSE-SU-2012:0978", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"}, {"name": "SUSE-SU-2012:1014", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"}, {"name": "openSUSE-SU-2012:1066", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"}, {"name": "[rubyonrails-security] 20120531 Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2660)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain"}, {"name": "RHSA-2013:0154", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-2660", "datePublished": "2012-06-22T14:00:00.000Z", "dateReserved": "2012-05-14T00:00:00.000Z", "dateUpdated": "2024-08-06T19:42:31.885Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "E3BE7DFE-BA20-434B-A1DE-AD038B255C60", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*", "matchCriteriaId": "DCEE5B21-C990-4705-8239-0D7B29DAEDA1", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "65EE33B1-B079-4CDE-B9C2-F1613A4610DC", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "5CAAA20B-824F-4448-99DC-9712FE628073", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "D2BEBDFB-0F30-454A-B74C-F820C9D2708B", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*", "matchCriteriaId": "1D7CD8C1-95D1-477E-AD96-6582EC33BA01", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "B6F00D98-3D0F-40AF-AE4F-090B1E6B660C", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "9476CE55-69C0-45D3-B723-6F459C90BF05", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*", "matchCriteriaId": "486F5BA6-BCF7-4691-9754-19D364B4438D", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "112FC73B-A8BC-4EEA-9F4B-CCE685EF2838", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*", "matchCriteriaId": "E4498383-6FCA-4E17-A1FD-B0CE7EE50F85", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "D26565B1-2BA6-4A3C-9264-7FC9A1820B59", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*", "matchCriteriaId": "644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "392E2D58-CB39-4832-B4D9-9C2E23B8E14C", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*", "matchCriteriaId": "1F2466EA-7039-46A1-B4A3-8DACD1953A59", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "0CAB4E72-0A15-4B26-9B69-074C278568D6", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*", "matchCriteriaId": "A085E105-9375-440A-80CB-9B23E6D7EB4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*", "matchCriteriaId": "25911E48-C5D7-4ED8-B4DB-7523A74CCF49", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "FE6EC1E5-3A4A-4751-9F77-28EF5AF681E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*", "matchCriteriaId": "B29674E3-CC80-446B-9A43-82594AE7A058", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*", "matchCriteriaId": "FF34D8CB-2B6D-4CB8-A206-108293BCFFE7", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "8E5187F6-E3AC-4E0D-B1D0-83DE76C20A4B", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "272268EE-E3E8-4683-B679-55D748877A7E", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "7B69FD33-61FE-4F10-BBE1-215F59035D30", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "08D7CB5D-82EF-4A24-A792-938FAB40863D", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*", "matchCriteriaId": "8A044B21-47D5-468D-AF4A-06B3B5CC0824", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "2196F3D0-532A-40F9-843A-1DFBC8B63FDC", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "CBEDA932-6CB5-438C-94E4-824732A91BE0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "903E5524-5E45-48CE-A804-EDAEBE3A79AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*", "matchCriteriaId": "08534AF2-F94E-4FB6-A572-4FB9827276D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*", "matchCriteriaId": "29E3B4A6-1346-4358-B7BC-84D00ED3ABBE", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*", "matchCriteriaId": "B52D7A6B-DD93-45F0-9186-18ABEFF28DF4", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "1F07C641-48DF-43BE-9EB5-72B337C54846", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*", "matchCriteriaId": "A1CB1B12-99F5-430F-AE19-9A95C17FA123", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*", "matchCriteriaId": "D1A7C449-8F9A-4CE5-9C3D-375996BFAEE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*", "matchCriteriaId": "05D5D58C-DB79-41EA-81AE-5D95C48211B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*", "matchCriteriaId": "FE331D6D-99BA-4369-AD8B-B556DEE4955F", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "05108EF0-81AD-4378-9843-5C23F2AC79A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "224BD488-0D7E-4F8B-9012-DE872DEB544C", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "DB51F3E9-4899-49A9-9E7B-0DCA92A91DD8", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "F884F2F4-94F3-46CB-860B-1BCC0EEF408A", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "88DFBB48-1C29-4639-9369-F5B413CA2337", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "D37696D7-BEE6-4587-9E33-A7FE24780409", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "E95B5D44-0C8D-47BC-A89D-48A5BDEB84F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "1DFDAF6A-76AA-436F-A4F3-DA69892DE2B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "D3172982-3FA4-427F-BE3E-2321D804E49D", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "FD6EC85B-F092-48FF-966A-96B9227C8656", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "9000F3C1-57A0-474C-9C82-E58688F29838", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*", "matchCriteriaId": "6E55E42E-AB6A-4E47-AC69-DFDAEB0A8735", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "A42F4E7A-6F6A-485C-8D30-95F3B0285922", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "30B9C0CB-F6E6-4233-84E4-D6E69104DD73", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "84309CC7-A8B7-4ADB-AEA1-964DA5F7B0E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "5343241F-274D-45FF-97C7-2BC2E920BAF0", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "FED122B8-AF4C-4C48-B1E5-54F4A7A31A53", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*", "matchCriteriaId": "157ACCAD-0FB8-4CC9-9DFB-70835DE6506C", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*", "matchCriteriaId": "3E50ACF6-7277-4C9A-B42A-E7EFDC317691", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "C191DC2B-1EC3-48E0-A586-867E6EE4431C", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "3AA51263-6680-42C6-B119-8241D6F76206", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*", "matchCriteriaId": "B4BC41E8-FEDA-4C31-B479-D49A59FC4D63", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*", "matchCriteriaId": "D1AEFA5D-A793-4BAB-8DED-3D3A31260AD8", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "2816C02C-E13E-4367-91F3-14756A90EC9E", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "E82AF7C7-B725-40EF-8EE3-18F8E7FAEB29", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "1AE674DE-65DB-437E-A034-A2EE5C584B33", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "0524F3E3-BAD7-4CD3-A6E7-74CFBE4B46E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "32EB2C3F-0F24-43DB-988E-BD2973598F71", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*", "matchCriteriaId": "EB32713D-FE64-445E-872E-B4678C243AB1", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "C55E6B4A-2B9C-46C8-A739-109EA4BA7FD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*", "matchCriteriaId": "89C618DC-38BC-4484-8C41-BC38B7EB636B", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*", "matchCriteriaId": "FE1EF01A-F358-45D3-ADA2-51DD1D8CB6E2", "vulnerable": true}, {"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*", "matchCriteriaId": "0E376782-98B0-4766-B6FC-67E032A00C62", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2694."}, {"lang": "es", "value": "actionpack/lib/action_dispatch/http/request.rb en Ruby on Rails antes de v3.0.13, v3.1.x antes de v3.1.5 y v3.2.x antes de v3.2.4 no tienen debidamente en cuenta las diferencias en el manejo de par\u00e1metros entre el componente Active Record y la interfaz Rack, lo que permite a atacantes remotos evitar las restricciones de consulta de bases de datos y realizar comprobaciones de nulos a trav\u00e9s de una solicitud hecha a mano, por ejemplo con valores \"[nil]\". Se trata de un problema relacionado con el CVE-2012-2694."}], "id": "CVE-2012-2660", "lastModified": "2026-06-16T23:41:49.633", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-06-22T14:55:01.020", "references": [{"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"}, {"source": "secalert@redhat.com", "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"}, {"source": "secalert@redhat.com", "tags": ["Exploit"], "url": "https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "converge-ui-devel-0:1.0.4-1.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "puppet-0:2.6.17-2.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-actionpack-1:3.0.10-10.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-activerecord-1:3.0.10-6.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-activesupport-1:3.0.10-4.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-chunky_png-0:1.2.0-3.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-compass-0:0.11.5-2.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-delayed_job-0:2.1.4-2.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-ldap_fluff-0:0.1.3-1.el6_3", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-mail-0:2.3.0-3.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-net-ldap-0:0.1.1-3.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2013:0154", "cpe": "cpe:/a:rhel_sam:1.1::el6", "package": "rubygem-actionpack-1:3.0.10-11.el6cf", "product_name": "Red Hat Subscription Asset Manager 1.1", "release_date": "2013-01-10T00:00:00Z"}, {"advisory": "RHSA-2013:0154", "cpe": "cpe:/a:rhel_sam:1.1::el6", "package": "rubygem-activerecord-1:3.0.10-8.el6cf", "product_name": "Red Hat Subscription Asset Manager 1.1", "release_date": "2013-01-10T00:00:00Z"}, {"advisory": "RHSA-2013:0154", "cpe": "cpe:/a:rhel_sam:1.1::el6", "package": "rubygem-activesupport-1:3.0.10-5.el6cf", "product_name": "Red Hat Subscription Asset Manager 1.1", "release_date": "2013-01-10T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "graphviz-0:2.26.0-10.el6", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-console-0:0.0.16-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-broker-0:1.0.11-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-broker-util-0:1.0.15-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-cartridge-cron-1.4-0:1.0.3-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-cartridge-diy-0.1-0:1.0.3-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-cartridge-haproxy-1.4-0:1.0.4-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-cartridge-jbosseap-6.0-0:1.0.4-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-cartridge-jbossews-1.0-0:1.0.13-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-cartridge-jenkins-1.4-0:1.0.2-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-cartridge-jenkins-client-1.4-0:1.0.2-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-cartridge-mysql-5.1-0:1.0.5-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-cartridge-perl-5.10-0:1.0.3-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-cartridge-php-5.3-0:1.0.5-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-cartridge-postgresql-8.4-0:1.0.3-2.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-cartridge-ruby-1.8-0:1.0.7-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-cartridge-ruby-1.9-scl-0:1.0.8-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "openshift-origin-msg-node-mcollective-0:1.0.3-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "php-0:5.3.3-22.el6", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "ruby193-ruby-0:1.9.3.327-25.el6", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "ruby193-rubygem-actionpack-1:3.2.8-3.el6", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "ruby193-rubygem-activemodel-0:3.2.8-2.el6", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "ruby193-rubygem-activerecord-1:3.2.8-3.el6", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "ruby193-rubygem-railties-0:3.2.8-2.el6", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "ruby193-rubygem-ruby_parser-0:2.3.1-3.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "rubygem-actionpack-1:3.0.13-4.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "rubygem-activemodel-0:3.0.13-3.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "rubygem-activerecord-1:3.0.13-5.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "rubygem-bson-0:1.8.1-2.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "rubygem-mongo-0:1.8.1-2.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "rubygem-openshift-origin-auth-remote-user-0:1.0.5-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "rubygem-openshift-origin-console-0:1.0.10-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "rubygem-openshift-origin-controller-0:1.0.12-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "rubygem-openshift-origin-node-0:1.0.11-1.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}, {"advisory": "RHSA-2013:0582", "cpe": "cpe:/a:redhat:openshift:1::el6", "package": "rubygem-ruby_parser-0:2.0.4-6.el6op", "product_name": "RHEL 6 Version of OpenShift Enterprise", "release_date": "2013-02-28T00:00:00Z"}], "bugzilla": {"description": "rubygem-actionpack: Unsafe query generation", "id": "827353", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=827353"}, "csaw": false, "cvss": {"cvss_base_score": "4.0", "cvss_scoring_vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N", "status": "verified"}, "details": ["actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2694."], "name": "CVE-2012-2660", "public_date": "2012-05-31T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2012-2660\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-2660"], "threat_severity": "Low"}

{}