CVE-2014-3514
Active Record subject to strong parameters protection bypass
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
Exploit likelihood
What each source reports
NVD Score used
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
- Record
CVE-2014-3514- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
- Record
CVE-2014-3514- Updated
- 2026-11-02
EUVDEUVD-2017-0209 No score
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
- Record
EUVD-2017-0209- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9rf5-jm6f-2fmm No score
Active Record subject to strong parameters protection bypass
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
- Record
GHSA-9rf5-jm6f-2fmm- Weakness
- CWE-284
- Updated
- 2026-11-02
OSV No score
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
- Record
CVE-2014-3514- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3514 No score
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
- Record
DEBIAN-CVE-2014-3514- Updated
- 2026-11-02
OSVGHSA-9rf5-jm6f-2fmm No score
Active Record subject to strong parameters protection bypass
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
- Record
GHSA-9rf5-jm6f-2fmm- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10207-1 No score
ruby2.2-rubygem-railties-4_2-4.2.7.1-1.1 on GA media
These are all security issues fixed in the ruby2.2-rubygem-railties-4_2-4.2.7.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10207-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecordRubyGems |
4.0.0 up to 4.0.9 | 4.0.9 |
activerecordRubyGems |
4.1.0 up to 4.1.5 | 4.1.5 |
railsDebian:12 |
before 2:4.1.5-1 | 2:4.1.5-1 |
railsDebian:13 |
before 2:4.1.5-1 | 2:4.1.5-1 |
railsDebian:14 |
before 2:4.1.5-1 | 2:4.1.5-1 |
activerecordRubyGems |
4.0.0 up to 4.0.9, plus listed versions 4.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc4 Show 11 moreShow less4.0.24.0.34.0.44.0.4.rc14.0.54.0.64.0.6.rc14.0.6.rc24.0.6.rc34.0.74.0.8 |
4.0.9 |
activerecordRubyGems |
4.1.0 up to 4.1.5, plus listed versions 4.1.14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.4 |
4.1.5 |
ror40-rubygem-activerecordRed Hat:rhel_software_collections:1::el6 |
before 1:4.0.2-2.3.el6 | 1:4.0.2-2.3.el6 |
ror40-rubygem-activerecord-docRed Hat:rhel_software_collections:1::el6 |
before 1:4.0.2-2.3.el6 | 1:4.0.2-2.3.el6 |
ror40-rubygem-activerecordRed Hat:rhel_software_collections:1::el7 |
before 1:4.0.2-2.3.el7 | 1:4.0.2-2.3.el7 |
ror40-rubygem-activerecord-docRed Hat:rhel_software_collections:1::el7 |
before 1:4.0.2-2.3.el7 | 1:4.0.2-2.3.el7 |
rubygem-railties-4_2openSUSE:Tumbleweed |
before 5.0.0.1-1.1 | 5.0.0.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3514 is a high vulnerability (CVSS 7.5) in Rubyonrails Rails, published August 20, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.80%, the 86th percentile. Fixed in activerecord 4.0.9.
References
groups.google.com/forum/message/raw?msg=rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ
secunia.com/advisories/60347
openwall.com/lists/oss-security/2014/08/18/10
rhn.redhat.com/errata/RHSA-2014-1102.html
nvd.nist.gov/vuln/detail/CVE-2014-3514
github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2014-3514.yml
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2014-3514
access.redhat.com/errata/RHSA-2014:1102
bugzilla.redhat.com/show_bug.cgi?id=1131240
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1102.json
cve.org/CVERecord?id=CVE-2014-3514
suse.com/security/cve/CVE-2014-3514