VDB
Sign up
HIGH

GHSA-xf96-32q2-9rw2

Rails ActiveRecord gem vulnerable to SQL injection

Quick fix

GHSA-xf96-32q2-9rw2 — activerecord: upgrade to the fixed version with the command below.

bundle update activerecord

Details

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) `:limit` and (2) `:offset` parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/activerecord
Introduced in: 0Fixed in: 2.1.1
Fixbundle update activerecord

References