CVE-2016-6317
ActiveRecord in Ruby on Rails allows database-query bypass
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
- Record
CVE-2016-6317- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-284, CWE-476
- Updated
- 2026-11-02
CVE List No score
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
- Record
CVE-2016-6317- Updated
- 2026-11-02
EUVDEUVD-2017-0283 No score
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
- Record
EUVD-2017-0283- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pr3r-4wrp-r2pv
ActiveRecord in Ruby on Rails allows database-query bypass
Active Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
- Record
GHSA-pr3r-4wrp-r2pv- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284, CWE-476
- Updated
- 2026-11-02
OSV
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
- Record
CVE-2016-6317- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-6317
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
- Record
DEBIAN-CVE-2016-6317- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-pr3r-4wrp-r2pv
ActiveRecord in Ruby on Rails allows database-query bypass
Active Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
- Record
GHSA-pr3r-4wrp-r2pv- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284, CWE-476
- Updated
- 2026-11-02
OSVRHSA-2016:1855
Red Hat Security Advisory: rh-ror42 security update
- Record
RHSA-2016:1855- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVSUSE-SU-2017:2716-1 No score
Security update for the Ruby on Rails stack
This update brings version 4.2.9 of the Ruby on Rails stack to provide the latest fixes and improvements from upstream.
The following security issues have been fixed by upstream:
rubygem-actionpack-4_2
- CVE-2016-2098: Action Pack in Ruby on Rails allowed remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method (bsc#968849).
rubygem-activerecord-4_2
- CVE-2016-6317: Action Record did not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allowed remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request (bsc#993313).
rubygem-actionview-4_2
- CVE-2016-6316: Cross-site scripting (XSS) vulnerability in Action View might have allowed remote attackers to inject arbitrary web script or HTML via text declared as 'HTML safe' and used as attribute values in tag handlers (bsc#993302).
Additionally, the following packages have been updated to version 4.2.9:
- rubygem-rails-4_2
- rubygem-railties-4_2
- rubygem-activesupport-4_2
- rubygem-activerecord-4_2
- rubygem-activejob-4_2
- rubygem-actionview-4_2
- rubygem-actionpack-4_2
- rubygem-actionmailer-4_2
- Record
SUSE-SU-2017:2716-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecordRubyGems |
4.2.0 to 4.2.7.0 | 4.2.7.1 |
railsDebian:12 |
before 2:4.2.7.1-1 | 2:4.2.7.1-1 |
railsDebian:13 |
before 2:4.2.7.1-1 | 2:4.2.7.1-1 |
railsDebian:14 |
before 2:4.2.7.1-1 | 2:4.2.7.1-1 |
activerecordRubyGems |
4.2.0 up to 4.2.7.1, plus listed versions 4.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc4 Show 14 moreShow less4.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.14.2.5.24.2.5.rc14.2.5.rc24.2.64.2.6.rc14.2.74.2.7.rc1 |
4.2.7.1 |
rh-ror42-rubygem-actionpackRed Hat:rhel_software_collections:2::el7 |
before 1:4.2.6-3.el7 | 1:4.2.6-3.el7 |
rh-ror42-rubygem-actionpack-docRed Hat:rhel_software_collections:2::el7 |
before 1:4.2.6-3.el7 | 1:4.2.6-3.el7 |
rh-ror42-rubygem-actionviewRed Hat:rhel_software_collections:2::el7 |
before 0:4.2.6-3.el7 | 0:4.2.6-3.el7 |
rh-ror42-rubygem-actionview-docRed Hat:rhel_software_collections:2::el7 |
before 0:4.2.6-3.el7 | 0:4.2.6-3.el7 |
rh-ror42-rubygem-activerecordRed Hat:rhel_software_collections:2::el7 |
before 1:4.2.6-3.el7 | 1:4.2.6-3.el7 |
Show 41 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rh-ror42-rubygem-activerecord-docRed Hat:rhel_software_collections:2::el7 |
before 1:4.2.6-3.el7 | 1:4.2.6-3.el7 |
rubygem-actionmailer-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionpack-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-actionview-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-9.3.1 | 4.2.9-9.3.1 |
rubygem-activejob-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-activemodel-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activerecord-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activesupport-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-rails-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-rails-html-sanitizerSUSE:OpenStack Cloud 6 |
before 1.0.3-8.3.1 | 1.0.3-8.3.1 |
rubygem-railties-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionmailer-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionpack-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-actionview-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-9.3.1 | 4.2.9-9.3.1 |
rubygem-activejob-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-activemodel-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activerecord-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activesupport-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-rails-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-rails-html-sanitizerSUSE:OpenStack Cloud 7 |
before 1.0.3-8.3.1 | 1.0.3-8.3.1 |
rubygem-railties-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionmailer-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionpack-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-actionview-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-9.3.1 | 4.2.9-9.3.1 |
rubygem-activejob-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-activemodel-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activerecord-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activesupport-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-rails-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-rails-html-sanitizerSUSE:Enterprise Storage 3 |
before 1.0.3-8.3.1 | 1.0.3-8.3.1 |
rubygem-railties-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionmailer-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionpack-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-actionview-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-9.3.1 | 4.2.9-9.3.1 |
rubygem-activejob-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-activemodel-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activerecord-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activesupport-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-rails-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-rails-html-sanitizerSUSE:Enterprise Storage 4 |
before 1.0.3-8.3.1 | 1.0.3-8.3.1 |
rubygem-railties-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | kavgan/vuln_test_repo_public_ruby_gemfile_cve-2016-6317 | 2017-09-26 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-6317 is a high vulnerability (CVSS 7.5) in Rubyonrails Rails, published September 7, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.90%, the 90th percentile. Fixed in activerecord 4.2.7.1.
References
securityfocus.com/bid/92434
openwall.com/lists/oss-security/2016/08/11/4
rhn.redhat.com/errata/RHSA-2016-1855.html
weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released
groups.google.com/forum
nvd.nist.gov/vuln/detail/CVE-2016-6317
Show 21 moreShow less
github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2016-6317.yml
security-tracker.debian.org/tracker/CVE-2016-6317
access.redhat.com/errata/RHSA-2016:1855
bugzilla.redhat.com/show_bug.cgi?id=1365008
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1855.json
cve.org/CVERecord?id=CVE-2016-6316
suse.com/support/update/announcement/2017/suse-su-20172716-1
bugzilla.suse.com/1055962