VULNERABILITY INTELLIGENCE

CVE-2011-0448

CVSS score7.5 HIGH
EPSS probability2.17%
CISA KEVNot currently listed
Published2011-02-21
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P

Description

Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.

Weakness classification

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Primary references