CVE-2014-3482
SQL Injection in Active Record
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
Exploit likelihood
What each source reports
NVD Score used
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
- Record
CVE-2014-3482- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
- Record
CVE-2014-3482- Updated
- 2026-11-02
EUVDEUVD-2017-0273 No score
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
- Record
EUVD-2017-0273- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mhwp-qhpc-h3jm No score
SQL Injection in Active Record
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
- Record
GHSA-mhwp-qhpc-h3jm- Weakness
- CWE-89
- Updated
- 2026-11-02
OSV No score
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
- Record
CVE-2014-3482- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3482 No score
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
- Record
DEBIAN-CVE-2014-3482- Updated
- 2026-11-02
OSVGHSA-mhwp-qhpc-h3jm No score
SQL Injection in Active Record
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
- Record
GHSA-mhwp-qhpc-h3jm- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecordRubyGems |
2.0.0 up to 3.2.19 | 3.2.19 |
railsDebian:12 |
before 2:4.1.4-1 | 2:4.1.4-1 |
railsDebian:13 |
before 2:4.1.4-1 | 2:4.1.4-1 |
railsDebian:14 |
before 2:4.1.4-1 | 2:4.1.4-1 |
ruby-activerecord-3.2Debian:7 From an advisory covering 2 CVEs |
before 3.2.6-5+deb7u1, plus listed versions 3.2.6-5 |
3.2.6-5+deb7u1 |
activerecordRubyGems |
2.0.0 up to 3.2.19, plus listed versions 2.0.12.0.22.0.42.0.52.1.0 Show 45 moreShow less2.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.152.3.162.3.172.3.182.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.8.pre12.3.92.3.9.pre3.0.03.0.0.beta3.0.0.beta23.0.0.beta33.0.0.beta43.0.0.rc3.0.0.rc23.0.13.0.103.0.10.rc13.0.113.0.123.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.20 |
3.2.19 |
ruby193-rubygem-activerecordRed Hat:rhel_software_collections:1::el6 |
before 1:3.2.8-8.2.el6 | 1:3.2.8-8.2.el6 |
ruby193-rubygem-activerecord-docRed Hat:rhel_software_collections:1::el6 |
before 1:3.2.8-8.2.el6 | 1:3.2.8-8.2.el6 |
ruby193-rubygem-activerecordRed Hat:rhel_software_collections:1::el7 |
before 1:3.2.8-8.2.el7 | 1:3.2.8-8.2.el7 |
ruby193-rubygem-activerecord-docRed Hat:rhel_software_collections:1::el7 |
before 1:3.2.8-8.2.el7 | 1:3.2.8-8.2.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3482 is a high vulnerability (CVSS 7.5) in Rubyonrails Rails, published July 7, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.28%, the 91st percentile. Fixed in activerecord 3.2.19.
References
securityfocus.com/bid/68343
secunia.com/advisories/59973
openwall.com/lists/oss-security/2014/07/02/5
groups.google.com/forum/message/raw?msg=rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J
Show 14 moreShow less
rhn.redhat.com/errata/RHSA-2014-0876.html
debian.org/security/2014/dsa-2982
nvd.nist.gov/vuln/detail/CVE-2014-3482
github.com/rails/rails/commit/1f2192e46d78ee0ba2b06373f2c24caf8440ff5b
security-tracker.debian.org/tracker/CVE-2014-3482
access.redhat.com/errata/RHSA-2014:0876
bugzilla.redhat.com/show_bug.cgi?id=1114425
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0876.json
cve.org/CVERecord?id=CVE-2014-3482
Left out here: 86 versions. The JSON record has them.