Detections
Analytics

SCA: security update for activerecord (GHSA-hq7p-j377-6v63)

high Tenable Self-Hosted Container Security Plugin ID 415893

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments.
 If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query
 method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the
 database withinsufficient sanitization and be able to inject SQL outside of the comment. (CVE-2023-22794)

See Also

https://github.com/advisories/GHSA-hq7p-j377-6v63

Plugin Details

Severity: High

ID: 415893

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.58

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-22794

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/18/2023

Vulnerability Publication Date: 1/18/2023

Reference Information

CVE: CVE-2023-22794

cwe: CWE-89