CVE-2008-4094
Rails ActiveRecord gem vulnerable to SQL injection
CVE-2008-4094 is a high vulnerability (CVSS 7.5) in Rubyonrails Rails, published September 30, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.03%, the 87th percentile. Fixed in activerecord 2.1.1.
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
Exploit likelihood
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
- Record
CVE-2008-4094- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
- Record
CVE-2008-4094- Updated
- 2026-11-02
EUVDEUVD-2017-0329 No score
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
- Record
EUVD-2017-0329- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xf96-32q2-9rw2 No score
Rails ActiveRecord gem vulnerable to SQL injection
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
- Record
GHSA-xf96-32q2-9rw2- Weakness
- CWE-89
- Updated
- 2026-11-02
OSV No score
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
- Record
CVE-2008-4094- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-4094 No score
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
- Record
DEBIAN-CVE-2008-4094- Updated
- 2026-11-02
OSVGHSA-xf96-32q2-9rw2 No score
Rails ActiveRecord gem vulnerable to SQL injection
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
- Record
GHSA-xf96-32q2-9rw2- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecordRubyGems |
before 2.1.1 | 2.1.1 |
railsDebian:12 |
before 2.1.0-1 | 2.1.0-1 |
railsDebian:13 |
before 2.1.0-1 | 2.1.0-1 |
railsDebian:14 |
before 2.1.0-1 | 2.1.0-1 |
activerecordRubyGems |
before 2.1.1, plus listed versions 1.0.01.1.01.10.01.10.11.11.0 Show 34 moreShow less1.11.11.12.11.12.21.13.01.13.11.13.21.14.01.14.11.14.21.14.31.14.41.15.01.15.11.15.21.15.31.15.41.15.51.15.61.2.01.3.01.4.01.5.01.5.11.6.01.7.01.8.01.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.0 |
2.1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
gist.github.com/8946
exchange.xforce.ibmcloud.com/vulnerabilities/45109
openwall.com/lists/oss-security/2008/09/13/2
rails.lighthouseapp.com/projects/8994/tickets/964
secunia.com/advisories/31875
Show 25 moreShow less
lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html
blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1
securitytracker.com/id?1020871
rorsecurity.info/2008/09/08/sql-injection-issue-in-limit-and-offset-parameter
securityfocus.com/bid/31176
vupen.com/english/advisories/2008/2562
nvd.nist.gov/vuln/detail/CVE-2008-4094
github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2008-4094.yml
web.archive.org/web/20080620000955/http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1
security-tracker.debian.org/tracker/CVE-2008-4094