CVE-2012-6496

Active Record contains SQL Injection

7.5 HighFix available

CVE-2012-6496 is a high vulnerability (CVSS 7.5) in Rubyonrails Rails, published January 4, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.58%, the 91st percentile. Fixed in activerecord 3.1.9.

SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.

Exploit likelihood

4.58%Up 2.6 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2012-6496
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-6496
Updated: 2026-11-02

EUVDEUVD-2017-0238 No score

Record: EUVD-2017-0238
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gh2w-j7cx-2664 No score

Active Record contains SQL Injection

SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.

Record: GHSA-gh2w-j7cx-2664
Weakness: CWE-89
Updated: 2026-11-02

OSV No score

Record: CVE-2012-6496
Updated: 2026-11-02

OSVDEBIAN-CVE-2012-6496 No score

Record: DEBIAN-CVE-2012-6496
Updated: 2026-11-02

OSVGHSA-gh2w-j7cx-2664 No score

Active Record contains SQL Injection

Record: GHSA-gh2w-j7cx-2664
Weakness: CWE-89
Updated: 2026-11-02

OSVUBUNTU-CVE-2012-6496 No score

Record: UBUNTU-CVE-2012-6496
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`activerecord` RubyGems	3.1.0 up to 3.1.9	3.1.9
`activerecord` RubyGems	3.2.0 up to 3.2.10	3.2.10
`activerecord` RubyGems	3.0.0.beta up to 3.0.18	3.0.18
`activerecord` RubyGems	before 2.3.15	2.3.15
`rails` Debian:12	before 2.3.14.1	2.3.14.1
`rails` Debian:13	before 2.3.14.1	2.3.14.1
`rails` Debian:14	before 2.3.14.1	2.3.14.1
`rails` Debian:6.0	before 2.3.5-1.2+squeeze4, plus listed versions 2.3.5-1.22.3.5-1.2+squeeze0.12.3.5-1.2+squeeze12.3.5-1.2+squeeze22.3.5-1.2+squeeze3	2.3.5-1.2+squeeze4
`activerecord` RubyGems	3.0.0.beta up to 3.0.18, plus listed versions 3.0.03.0.0.beta23.0.0.beta33.0.0.beta43.0.0.rc Show 34 moreShow less 3.0.0.rc23.0.13.0.103.0.10.rc13.0.113.0.123.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.23.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc5	3.0.18
`activerecord` RubyGems	3.1.0 up to 3.1.9, plus listed versions 3.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.2 Show 10 moreShow less 3.1.2.rc13.1.2.rc23.1.33.1.43.1.4.rc13.1.53.1.5.rc13.1.63.1.73.1.8	3.1.9

Show 36 moreShow less

Affected packages
Package	Affected	Fixed
`activerecord` RubyGems	3.2.0 up to 3.2.10, plus listed versions 3.2.13.2.23.2.2.rc13.2.33.2.3.rc1 Show 14 moreShow less 3.2.3.rc23.2.43.2.4.rc13.2.53.2.63.2.73.2.7.rc13.2.83.2.8.rc13.2.8.rc23.2.93.2.9.rc13.2.9.rc23.2.9.rc3	3.2.10
`activerecord` RubyGems	before 2.3.15, plus listed versions 1.0.01.1.01.10.01.10.11.11.0 Show 45 moreShow less 1.11.11.12.11.12.21.13.01.13.11.13.21.14.01.14.11.14.21.14.31.14.41.15.01.15.11.15.21.15.31.15.41.15.51.15.61.2.01.3.01.4.01.5.01.5.11.6.01.7.01.8.01.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.22.3.32.3.4	2.3.15
`rhc` Red Hat:openshift:1::el6	before 0:1.3.2-1.3.el6op	0:1.3.2-1.3.el6op
`libmongodb` Red Hat:openshift:1::el6	before 0:2.0.2-6.el6op	0:2.0.2-6.el6op
`mongodb` Red Hat:openshift:1::el6	before 0:2.0.2-6.el6op	0:2.0.2-6.el6op
`mongodb-debuginfo` Red Hat:openshift:1::el6	before 0:2.0.2-6.el6op	0:2.0.2-6.el6op
`mongodb-devel` Red Hat:openshift:1::el6	before 0:2.0.2-6.el6op	0:2.0.2-6.el6op
`mongodb-server` Red Hat:openshift:1::el6	before 0:2.0.2-6.el6op	0:2.0.2-6.el6op
`openshift-console` Red Hat:openshift:1::el6	before 0:0.0.13-2.el6op	0:0.0.13-2.el6op
`openshift-origin-broker` Red Hat:openshift:1::el6	before 0:1.0.10-1.el6op	0:1.0.10-1.el6op
`openshift-origin-broker-util` Red Hat:openshift:1::el6	before 0:1.0.14-1.el6op	0:1.0.14-1.el6op
`ruby193-mod_passenger` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`ruby193-rubygem-activerecord` Red Hat:openshift:1::el6	before 1:3.2.8-2.el6	1:3.2.8-2.el6
`ruby193-rubygem-activerecord-doc` Red Hat:openshift:1::el6	before 1:3.2.8-2.el6	1:3.2.8-2.el6
`ruby193-rubygem-passenger` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`ruby193-rubygem-passenger-debuginfo` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`ruby193-rubygem-passenger-devel` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`ruby193-rubygem-passenger-doc` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`ruby193-rubygem-passenger-native` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`ruby193-rubygem-passenger-native-libs` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`rubygem-activerecord` Red Hat:openshift:1::el6	before 1:3.0.13-3.el6op	1:3.0.13-3.el6op
`rubygem-openshift-origin-auth-remote-user` Red Hat:openshift:1::el6	before 0:1.0.4-2.el6op	0:1.0.4-2.el6op
`rubygem-openshift-origin-common` Red Hat:openshift:1::el6	before 0:1.0.2-1.el6op	0:1.0.2-1.el6op
`rubygem-openshift-origin-console` Red Hat:openshift:1::el6	before 0:1.0.6-1.el6op	0:1.0.6-1.el6op
`rubygem-openshift-origin-console-doc` Red Hat:openshift:1::el6	before 0:1.0.6-1.el6op	0:1.0.6-1.el6op
`rubygem-openshift-origin-controller` Red Hat:openshift:1::el6	before 0:1.0.11-1.el6op	0:1.0.11-1.el6op
`rubygem-openshift-origin-dns-bind` Red Hat:openshift:1::el6	before 0:1.0.2-1.el6op	0:1.0.2-1.el6op
`rubygem-openshift-origin-msg-broker-mcollective` Red Hat:openshift:1::el6	before 0:1.0.4-1.el6op	0:1.0.4-1.el6op
`jenkins` Red Hat:openshift:1::el6	before 0:1.498-1.1.el6op	0:1.498-1.1.el6op
`openshift-origin-cartridge-haproxy-1.4` Red Hat:openshift:1::el6	before 0:1.0.3-1.el6op	0:1.0.3-1.el6op
`openshift-origin-cartridge-ruby-1.8` Red Hat:openshift:1::el6	before 0:1.0.5-1.el6op	0:1.0.5-1.el6op
`openshift-origin-cartridge-ruby-1.9-scl` Red Hat:openshift:1::el6	before 0:1.0.5-1.el6op	0:1.0.5-1.el6op
`openshift-origin-msg-node-mcollective` Red Hat:openshift:1::el6	before 0:1.0.2-1.el6op	0:1.0.2-1.el6op
`openshift-origin-node-util` Red Hat:openshift:1::el6	before 0:1.0.7-1.el6op	0:1.0.7-1.el6op
`openshift-origin-port-proxy` Red Hat:openshift:1::el6	before 0:1.0.3-1.el6op	0:1.0.3-1.el6op
`rubygem-openshift-origin-node` Red Hat:openshift:1::el6	before 0:1.0.10-6.el6op	0:1.0.10-6.el6op