Not rated
CVE-2023-22794 A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments
Description
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| https://github.com/rails/rails | Versions not published |
References
- discuss.rubyonrails.org discuss.rubyonrails.org
- DSA-5372 www.debian.org
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of https://github.com/rails/rails
The 27 CVEs of https://github.com/rails/rails →
CVE-2023-22796
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1
Not rated
CVE-2022-44566
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1
7.5
High
CVE-2023-22795
A regular expression based DoS vulnerability in Action…
Not rated
CVE-2023-22797
An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling…
6.1
Medium