CVE-2012-2695

Quick assessment

Copy summary Copy citation

Affected

n/a n/a

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ruby on Rails（Rails）是Rails核心团队开发维护的一套基于Ruby语言的开源Web应用框架，它是由大卫-海纳梅尔-韩森从美国37signals公司的项目管理工具Basecamp里分离出来的。 Rails on Ruby中的Active Record组件中存在漏洞，该漏洞源于在SQL查询中使用了未正确验证的输入，这些输入是通过嵌套查询参数传递到Active Record接口的。攻击者可利用该漏洞通过注入任意SQL代码操纵SQL查询。

CVE-2012-2695 affects n/a n/a. No confirmed in-the-wild exploitation; assess based on exposure. Ruby on Rails（Rails）是Rails核心团队开发维护的一套基于Ruby语言的开源Web应用框架，它是由大卫-海纳梅尔-韩森从美国37signals公司的项目管理工具Basecamp里分离出来的。 Rails on Ruby中的Active Record组件中存在漏洞，该漏洞源于在SQL查询中使用了未正确验证的输入，这些输入是通过嵌套查询参数传 CVE-2012-2695 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2012-2695

I. Basic Information for CVE-2012-2695

Affected Products

II. Public POCs for CVE-2012-2695

III. Intelligence Information for CVE-2012-2695

Vendor Advisories for CVE-2012-2695 (1)

• http://rhn.redhat.com/errata/RHSA-2013-0154.html vendor-advisory x_refsource_REDHAT

Mailing List Discussions for CVE-2012-2695 (4)

• http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html vendor-advisory x_refsource_SUSE

Other References for CVE-2012-2695 (1)

• https://groups.google.com/group/rubyonrails-security/msg/aee3413fb038bf56?dmode=source&output=gplain mailing-list x_refsource_MLIST

• https://www.cve.org/CVERecord?id=CVE-2012-2695

Same Patch Batch · n/a · 2012-06-22 · 11 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2012-2695