CVE-2011-0448
activerecord vulnerable to SQL Injection
CVE-2011-0448 is a high vulnerability (CVSS 7.5) in Rubyonrails Rails, published February 21, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.17%, the 82nd percentile. Fixed in activerecord 3.0.4.
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
Exploit likelihood
What each source reports
NVD Score used
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
- Record
CVE-2011-0448- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
- Record
CVE-2011-0448- Updated
- 2026-11-02
EUVDEUVD-2017-0265 No score
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
- Record
EUVD-2017-0265- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jmm9-2p29-vh2w No score
activerecord vulnerable to SQL Injection
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
- Record
GHSA-jmm9-2p29-vh2w- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-jmm9-2p29-vh2w No score
activerecord vulnerable to SQL Injection
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
- Record
GHSA-jmm9-2p29-vh2w- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecordRubyGems |
3.0.0 up to 3.0.4 | 3.0.4 |
activerecordRubyGems |
3.0.0 up to 3.0.4, plus listed versions 3.0.13.0.23.0.33.0.4.rc1 |
3.0.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
groups.google.com/group/rubyonrails-security/msg/4e19864cf6ad40ad?dmode=source&output=gplain
weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
securitytracker.com/id?1025063
lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
secunia.com/advisories/43278
vupen.com/english/advisories/2011/0877
Show 6 moreShow less
github.com/rails/rails/commit/354da43ab0a10b3b7b3f9cb0619aa562c3be8474
nvd.nist.gov/vuln/detail/CVE-2011-0448
web.archive.org/web/20201220214809/http://securitytracker.com/id?1025063