CVE-2014-3514

Description

activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.

References

https://github.com/advisories/GHSA-hm48-76wh-q86v

https://github.com/advisories/GHSA-9rf5-jm6f-2fmm

https://groups.google.com/forum/message/raw?msg=rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ

https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-0209

http://secunia.com/advisories/60347

http://rhn.redhat.com/errata/RHSA-2014-1102.html

http://openwall.com/lists/oss-security/2014/08/18/10

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS