Non notée
CVE-2023-22794 A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments
Description
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| https://github.com/rails/rails | Versions non publiées |
Références
- discuss.rubyonrails.org discuss.rubyonrails.org
- DSA-5372 www.debian.org
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de https://github.com/rails/rails
Les 27 CVE de https://github.com/rails/rails →
CVE-2023-22796
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1
Non notée
CVE-2022-44566
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1
7.5
Élevée
CVE-2023-22795
A regular expression based DoS vulnerability in Action…
Non notée
CVE-2023-22797
An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling…
6.1
Moyenne