CVE-2011-2930
activerecord vulnerable to SQL Injection
CVE-2011-2930 is a high vulnerability (CVSS 7.5) in Rubyonrails Rails, published August 29, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.32%, the 83rd percentile. Fixed in activerecord 2.3.13.
Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
Exploit likelihood
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
- Record
CVE-2011-2930- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
- Record
CVE-2011-2930- Updated
- 2026-11-02
EUVDEUVD-2017-0247 No score
Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
- Record
EUVD-2017-0247- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h6w6-xmqv-7q78 No score
activerecord vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
- Record
GHSA-h6w6-xmqv-7q78- Weakness
- CWE-89
- Updated
- 2026-11-02
OSV No score
Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
- Record
CVE-2011-2930- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-2930 No score
Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
- Record
DEBIAN-CVE-2011-2930- Updated
- 2026-11-02
OSVGHSA-h6w6-xmqv-7q78 No score
activerecord vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
- Record
GHSA-h6w6-xmqv-7q78- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecordRubyGems |
2.0.0 up to 2.3.13 | 2.3.13 |
activerecordRubyGems |
3.0.0.beta up to 3.0.10 | 3.0.10 |
activerecordRubyGems |
3.1.0.beta1 up to 3.1.0.rc5 | 3.1.0.rc5 |
railsDebian:12 |
before 2.3.14 | 2.3.14 |
railsDebian:13 |
before 2.3.14 | 2.3.14 |
railsDebian:14 |
before 2.3.14 | 2.3.14 |
railsDebian:6.0 |
before 2.3.5-1.2+squeeze1, plus listed versions 2.3.5-1.22.3.5-1.2+squeeze0.1 |
2.3.5-1.2+squeeze1 |
railsDebian:5.0 |
before 2.1.0-7+lenny1, plus listed versions 2.1.0-62.1.0-72.1.0-7+lenny0.12.1.0-7+lenny0.2 |
2.1.0-7+lenny1 |
activerecordRubyGems |
2.0.0 up to 2.3.13, plus listed versions 2.0.12.0.22.0.42.0.52.1.0 Show 17 moreShow less2.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.8.pre12.3.92.3.9.pre |
2.3.13 |
activerecordRubyGems |
3.0.0.beta up to 3.0.10, plus listed versions 3.0.03.0.0.beta23.0.0.beta33.0.0.beta43.0.0.rc Show 24 moreShow less3.0.0.rc23.0.13.0.10.rc13.0.23.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc5 |
3.0.10 |
activerecordRubyGems |
3.1.0.beta1 up to 3.1.0.rc5, plus listed versions 3.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc4 |
3.1.0.rc5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2011/08/17/1
github.com/rails/rails/commit/8a39f411dc3c806422785b1f4d5c7c9d58e4bf85
lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
debian.org/security/2011/dsa-2301
Show 11 moreShow less
groups.google.com/group/rubyonrails-security/msg/b1a85d36b0f9dd30?dmode=source&output=gplain
bugzilla.redhat.com/show_bug.cgi?id=731438
weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
nvd.nist.gov/vuln/detail/CVE-2011-2930
security-tracker.debian.org/tracker/CVE-2011-2930