CVE Vulnerabilities

CVE-2012-2660

Published: Jun 22, 2012 | Modified: Aug 08, 2019
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
6.4 MEDIUM
AV:N/AC:L/Au:N/C:P/I:P/A:N
RedHat/V2
4 LOW
AV:N/AC:H/Au:N/C:P/I:P/A:N
RedHat/V3
Ubuntu

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain [nil] values, a related issue to CVE-2012-2694.

Affected Software

Name Vendor Start Version End Version
Rails Rubyonrails 3.0.0 3.0.0
Rails Rubyonrails 3.0.0 3.0.0
Rails Rubyonrails 3.0.0 3.0.0
Rails Rubyonrails 3.0.0 3.0.0
Rails Rubyonrails 3.0.0 3.0.0
Rails Rubyonrails 3.0.0 3.0.0
Rails Rubyonrails 3.0.0 3.0.0
Rails Rubyonrails 3.0.1 3.0.1
Rails Rubyonrails 3.0.1 3.0.1
Rails Rubyonrails 3.0.2 3.0.2
Rails Rubyonrails 3.0.2 3.0.2
Rails Rubyonrails 3.0.3 3.0.3
Rails Rubyonrails 3.0.4 3.0.4
Rails Rubyonrails 3.0.5 3.0.5
Rails Rubyonrails 3.0.5 3.0.5
Rails Rubyonrails 3.0.6 3.0.6
Rails Rubyonrails 3.0.6 3.0.6
Rails Rubyonrails 3.0.6 3.0.6
Rails Rubyonrails 3.0.7 3.0.7
Rails Rubyonrails 3.0.7 3.0.7
Rails Rubyonrails 3.0.7 3.0.7
Rails Rubyonrails 3.0.8 3.0.8
Rails Rubyonrails 3.0.8 3.0.8
Rails Rubyonrails 3.0.8 3.0.8
Rails Rubyonrails 3.0.8 3.0.8
Rails Rubyonrails 3.0.8 3.0.8
Rails Rubyonrails 3.0.9 3.0.9
Rails Rubyonrails 3.0.9 3.0.9
Rails Rubyonrails 3.0.9 3.0.9
Rails Rubyonrails 3.0.9 3.0.9
Rails Rubyonrails 3.0.9 3.0.9
Rails Rubyonrails 3.0.9 3.0.9
Rails Rubyonrails 3.0.10 3.0.10
Rails Rubyonrails 3.0.10 3.0.10
Rails Rubyonrails 3.0.11 3.0.11
Rails Rubyonrails 3.0.12 3.0.12
Rails Rubyonrails 3.0.12 3.0.12
Rails Rubyonrails 3.0.13 3.0.13
Ruby_on_rails Rubyonrails 3.0.4 3.0.4
CloudForms for RHEL 6 RedHat converge-ui-devel-0:1.0.4-1.el6cf *
CloudForms for RHEL 6 RedHat puppet-0:2.6.17-2.el6cf *
CloudForms for RHEL 6 RedHat rubygem-actionpack-1:3.0.10-10.el6cf *
CloudForms for RHEL 6 RedHat rubygem-activerecord-1:3.0.10-6.el6cf *
CloudForms for RHEL 6 RedHat rubygem-activesupport-1:3.0.10-4.el6cf *
CloudForms for RHEL 6 RedHat rubygem-chunky_png-0:1.2.0-3.el6cf *
CloudForms for RHEL 6 RedHat rubygem-compass-0:0.11.5-2.el6cf *
CloudForms for RHEL 6 RedHat rubygem-compass-960-plugin-0:0.10.4-2.el6cf *
CloudForms for RHEL 6 RedHat rubygem-delayed_job-0:2.1.4-2.el6cf *
CloudForms for RHEL 6 RedHat rubygem-ldap_fluff-0:0.1.3-1.el6_3 *
CloudForms for RHEL 6 RedHat rubygem-mail-0:2.3.0-3.el6cf *
CloudForms for RHEL 6 RedHat rubygem-net-ldap-0:0.1.1-3.el6cf *
Red Hat Subscription Asset Manager 1.1 RedHat rubygem-actionpack-1:3.0.10-11.el6cf *
Red Hat Subscription Asset Manager 1.1 RedHat rubygem-activerecord-1:3.0.10-8.el6cf *
Red Hat Subscription Asset Manager 1.1 RedHat rubygem-activesupport-1:3.0.10-5.el6cf *
RHEL 6 Version of OpenShift Enterprise RedHat graphviz-0:2.26.0-10.el6 *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-console-0:0.0.16-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-broker-0:1.0.11-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-broker-util-0:1.0.15-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-cartridge-cron-1.4-0:1.0.3-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-cartridge-diy-0.1-0:1.0.3-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-cartridge-haproxy-1.4-0:1.0.4-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-cartridge-jbosseap-6.0-0:1.0.4-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-cartridge-jbossews-1.0-0:1.0.13-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-cartridge-jenkins-1.4-0:1.0.2-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-cartridge-jenkins-client-1.4-0:1.0.2-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-cartridge-mysql-5.1-0:1.0.5-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-cartridge-perl-5.10-0:1.0.3-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-cartridge-php-5.3-0:1.0.5-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-cartridge-postgresql-8.4-0:1.0.3-2.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-cartridge-ruby-1.8-0:1.0.7-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-cartridge-ruby-1.9-scl-0:1.0.8-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat openshift-origin-msg-node-mcollective-0:1.0.3-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat php-0:5.3.3-22.el6 *
RHEL 6 Version of OpenShift Enterprise RedHat ruby193-ruby-0:1.9.3.327-25.el6 *
RHEL 6 Version of OpenShift Enterprise RedHat ruby193-rubygem-actionpack-1:3.2.8-3.el6 *
RHEL 6 Version of OpenShift Enterprise RedHat ruby193-rubygem-activemodel-0:3.2.8-2.el6 *
RHEL 6 Version of OpenShift Enterprise RedHat ruby193-rubygem-activerecord-1:3.2.8-3.el6 *
RHEL 6 Version of OpenShift Enterprise RedHat ruby193-rubygem-railties-0:3.2.8-2.el6 *
RHEL 6 Version of OpenShift Enterprise RedHat ruby193-rubygem-ruby_parser-0:2.3.1-3.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat rubygem-actionpack-1:3.0.13-4.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat rubygem-activemodel-0:3.0.13-3.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat rubygem-activerecord-1:3.0.13-5.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat rubygem-bson-0:1.8.1-2.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat rubygem-mongo-0:1.8.1-2.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat rubygem-openshift-origin-auth-remote-user-0:1.0.5-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat rubygem-openshift-origin-console-0:1.0.10-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat rubygem-openshift-origin-controller-0:1.0.12-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat rubygem-openshift-origin-node-0:1.0.11-1.el6op *
RHEL 6 Version of OpenShift Enterprise RedHat rubygem-ruby_parser-0:2.0.4-6.el6op *
Rails Ubuntu hardy *
Rails Ubuntu lucid *
Rails Ubuntu natty *
Ruby-rails-2.3 Ubuntu oneiric *
Ruby-rails-2.3 Ubuntu precise *
Ruby-rails-2.3 Ubuntu quantal *
Ruby-rails-2.3 Ubuntu raring *
Ruby-rails-2.3 Ubuntu saucy *

References