CVE-2012-6496

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-01-04 · updated 2026-06-16
Weakness: CWE-89

Description

SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.

Affected products

Ruby on Rails: 3.1.0, 3.1.0-beta1, 3.1.0-rc1, 3.1.0-rc2, 3.1.0-rc3, 3.1.0-rc4 (+76)
rubyonrails Ruby On Rails: through 3.0.17; 3.0.4

References

http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/
http://rhn.redhat.com/errata/RHSA-2013-0154.html
http://rhn.redhat.com/errata/RHSA-2013-0155.html
http://rhn.redhat.com/errata/RHSA-2013-0220.html
http://rhn.redhat.com/errata/RHSA-2013-0544.html
http://security.gentoo.org/glsa/glsa-201401-22.xml
http://www.securityfocus.com/bid/57084
https://bugzilla.redhat.com/show_bug.cgi?id=889649
https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source&output=gplain
http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/
http://rhn.redhat.com/errata/RHSA-2013-0154.html
http://rhn.redhat.com/errata/RHSA-2013-0155.html

Get alerted when CVE-2012-6496 or the next vulnerability affects your stack