CVE-2017-17916
CVE-2017-17916
This page contains facts from public vulnerability sources. Check the original advisory before updating.
SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input
CVSS 8.1 · High · EPSS 1.5%
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
rails Debian:12
- Versions
- 2:6.1.7.10+dfsg-1~deb12u1
- 2:6.1.7.10+dfsg-1~deb12u2
- 2:6.1.7.3+dfsg-1
- 2:6.1.7.3+dfsg-10
- 2:6.1.7.3+dfsg-11
- 2:6.1.7.3+dfsg-12
- 2:6.1.7.3+dfsg-13
- 2:6.1.7.3+dfsg-2
- 2:6.1.7.3+dfsg-2~deb12u1
- 2:6.1.7.3+dfsg-3
- 2:6.1.7.3+dfsg-4
- 2:6.1.7.3+dfsg-5
- 2:6.1.7.3+dfsg-6
- 2:6.1.7.3+dfsg-7
- 2:6.1.7.3+dfsg-7~exp1
- 2:6.1.7.3+dfsg-8
- 2:6.1.7.3+dfsg-9
- 2:7.2.2.1+dfsg-1
- 2:7.2.2.1+dfsg-1~exp1
- 2:7.2.2.1+dfsg-1~exp2
- 2:7.2.2.1+dfsg-1~exp3
- 2:7.2.2.1+dfsg-1~exp4
- 2:7.2.2.1+dfsg-1~exp6
- 2:7.2.2.1+dfsg-2
- 2:7.2.2.1+dfsg-3
- 2:7.2.2.1+dfsg-4
- 2:7.2.2.1+dfsg-5
- 2:7.2.2.1+dfsg-6
- 2:7.2.2.1+dfsg-7
- 2:7.2.2.2+dfsg-1
- 2:7.2.2.2+dfsg-2
- 2:7.2.2.2+dfsg-2~deb13u1
- 2:7.2.3+dfsg-1
- 2:7.2.3+dfsg-2
- 2:7.2.3+dfsg-3
- 2:7.2.3.1+dfsg-1
- 2:7.2.3.2+dfsg-1
- 2:7.2.3.2+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rails Debian:13
- Versions
- 2:7.2.2.1+dfsg-7
- 2:7.2.2.2+dfsg-1
- 2:7.2.2.2+dfsg-2
- 2:7.2.2.2+dfsg-2~deb13u1
- 2:7.2.3+dfsg-1
- 2:7.2.3+dfsg-2
- 2:7.2.3+dfsg-3
- 2:7.2.3.1+dfsg-1
- 2:7.2.3.2+dfsg-1
- 2:7.2.3.2+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rails Debian:14
- Versions
- 2:7.2.2.1+dfsg-7
- 2:7.2.2.2+dfsg-1
- 2:7.2.2.2+dfsg-2
- 2:7.2.2.2+dfsg-2~deb13u1
- 2:7.2.3+dfsg-1
- 2:7.2.3+dfsg-2
- 2:7.2.3+dfsg-3
- 2:7.2.3.1+dfsg-1
- 2:7.2.3.2+dfsg-1
- 2:7.2.3.2+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published