VULNERABILITY INTELLIGENCE

CVE-2012-2660

CVSS score6.4 MEDIUM
EPSS probability4.60%
CISA KEVNot currently listed
Published2012-06-22
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:N

Description

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.

Primary references