VDB
CVE-2008-4094
CVE-2008-4094
PUBLISHED
CVSS 7.5 HIGH
Rails ActiveRecord gem vulnerable to SQL injection
EPSS 3.03% · 87.2th percentile
Risk Scores
CVSS 2.0
7.5
EPSS Score
3.03%
87.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| RubyGems | activerecord | 0 |
| rubyonrails | ruby_on_rails | 0, 0.5.0, 0.5.5 |
| rubyonrails | rails | 0.14.2, 0.14.3, 0.14.4 |
Timeline
- Sep 30, 2008 CVE Published
- Sep 21, 2021 CVE Updated
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Oct 28, 2022 EPSS Score
- Dec 20, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 5, 2023 EPSS Score
- May 28, 2023 EPSS Score
References
- http://rails.lighthouseapp.com/projects/8994/tickets/964 url
- http://rails.lighthouseapp.com/projects/8994/tickets/288 url
- 31875 third-party-advisory
- SUSE-SR:2008:027 vendor-advisory
- 1020871 vdb
- http://www.rorsecurity.info/2008/09/08/sql-injection-issue-in-limit-and-offset-parameter/ url
- [oss-security] 20080915 Re: CVE request: Ruby on Rails <2.1.1 :limit and :offset SQL injection mailing-list
- ADV-2008-2562 vdb
- http://gist.github.com/8946 url
- rubyonrails-activerecord-sql-injection(45109) vdb
- [oss-security] 20080913 CVE request: Ruby on Rails <2.1.1 :limit and :offset SQL injection mailing-list
- 31910 third-party-advisory
- http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1 url
- 31176 vdb
- 31909 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2008-4094 advisory
- https://github.com/rails/rails/commit/ef0ea782b1f5cf7b08e74ea3002a16c708f66645 url
- https://github.com/rails/rails package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2008-4094.yml url
- https://web.archive.org/web/20080620000955/http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1 url
…and 10 more