The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby-actionmailer.Upgrade ruby-redmine-actionmailer. | Aug 30, 2017 | Dec 6, 2013 |
| Debian | — | Upgrade ruby-actionpack-3.2 | Jul 30, 2024 | Dec 7, 2013 |
| Freebsd | — | Upgrade rubygem-railtiesUpgrade rubygem-activesupport4Upgrade rubygem-actionpack4Upgrade rubygem-activerecordUpgrade rubygem-activesupportUpgrade rubygem-activemodelUpgrade rubygem-railsUpgrade rubygem-activeresourceUpgrade rubygem-actionmailerUpgrade rubygem-actionpack | Dec 10, 2025 | Dec 8, 2013 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Jan 3, 2020 | Dec 7, 2013 |
| Suse | — | Upgrade hawk-templatesUpgrade rubygem-actionpack-2_3Upgrade rubygem-actionpack-3_2Upgrade rubygem-actionpack-3_2-docUpgrade sle-hae-releaseUpgrade hawkUpgrade sle-sdk-release | Dec 23, 2013 | Dec 6, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub