CVE-2014-3483
Active Record contains SQL Injection via improper range quoting
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
Exploit likelihood
What each source reports
NVD Score used
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
- Record
CVE-2014-3483- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
- Record
CVE-2014-3483- Updated
- 2026-11-02
EUVDEUVD-2017-0298 No score
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
- Record
EUVD-2017-0298- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r8fh-hq2p-7qhq No score
Active Record contains SQL Injection via improper range quoting
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
- Record
GHSA-r8fh-hq2p-7qhq- Weakness
- CWE-89
- Updated
- 2026-11-02
OSV No score
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
- Record
CVE-2014-3483- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3483 No score
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
- Record
DEBIAN-CVE-2014-3483- Updated
- 2026-11-02
OSVGHSA-r8fh-hq2p-7qhq No score
Active Record contains SQL Injection via improper range quoting
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
- Record
GHSA-r8fh-hq2p-7qhq- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVMGASA-2014-0303 No score
Updated ruby-actionpack packages fix security issues
Updated ruby-actionpack and ruby-activerecord packages fix security vulnerabilities:
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 4.0.5, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request (CVE-2014-0130).
PostgreSQL supports a number of unique data types which are not present in other supported databases. A bug in the SQL quoting code in ActiveRecord in Ruby on Rails before 4.0.7 can allow an attacker to inject arbitrary SQL using carefully crafted values (CVE-2014-3483).
The associated Ruby on Rails packages have been updated to version 4.0.8, to address these and other issues.
- Record
MGASA-2014-0303- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecordRubyGems |
4.0.0 up to 4.0.7 | 4.0.7 |
activerecordRubyGems |
4.1.0 up to 4.1.3 | 4.1.3 |
railsDebian:12 |
before 2:4.1.4-1 | 2:4.1.4-1 |
railsDebian:13 |
before 2:4.1.4-1 | 2:4.1.4-1 |
railsDebian:14 |
before 2:4.1.4-1 | 2:4.1.4-1 |
ruby-activerecord-3.2Debian:7 From an advisory covering 2 CVEs |
before 3.2.6-5+deb7u1, plus listed versions 3.2.6-5 |
3.2.6-5+deb7u1 |
activerecordRubyGems |
4.0.0 up to 4.0.7, plus listed versions 4.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc4 Show 9 moreShow less4.0.24.0.34.0.44.0.4.rc14.0.54.0.64.0.6.rc14.0.6.rc24.0.6.rc3 |
4.0.7 |
activerecordRubyGems |
4.1.0 up to 4.1.3, plus listed versions 4.1.14.1.24.1.2.rc14.1.2.rc24.1.2.rc3 |
4.1.3 |
ruby-actionmailerMageia:4 From an advisory covering 2 CVEs |
before 4.0.8-1.mga4 | 4.0.8-1.mga4 |
ruby-actionpackMageia:4 From an advisory covering 2 CVEs |
before 4.0.8-1.mga4 | 4.0.8-1.mga4 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ruby-activemodelMageia:4 From an advisory covering 2 CVEs |
before 4.0.8-1.mga4 | 4.0.8-1.mga4 |
ruby-activerecordMageia:4 From an advisory covering 2 CVEs |
before 4.0.8-1.mga4 | 4.0.8-1.mga4 |
ruby-activesupportMageia:4 From an advisory covering 2 CVEs |
before 4.0.8-1.mga4 | 4.0.8-1.mga4 |
ruby-railsMageia:4 From an advisory covering 2 CVEs |
before 4.0.8-1.mga4 | 4.0.8-1.mga4 |
ruby-railtiesMageia:4 From an advisory covering 2 CVEs |
before 4.0.8-1.mga4 | 4.0.8-1.mga4 |
ror40-rubygem-activerecordRed Hat:rhel_software_collections:1::el6 |
before 1:4.0.2-2.2.el6 | 1:4.0.2-2.2.el6 |
ror40-rubygem-activerecord-docRed Hat:rhel_software_collections:1::el6 |
before 1:4.0.2-2.2.el6 | 1:4.0.2-2.2.el6 |
ror40-rubygem-activerecordRed Hat:rhel_software_collections:1::el7 |
before 1:4.0.2-2.2.el7 | 1:4.0.2-2.2.el7 |
ror40-rubygem-activerecord-docRed Hat:rhel_software_collections:1::el7 |
before 1:4.0.2-2.2.el7 | 1:4.0.2-2.2.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3483 is a high vulnerability (CVSS 7.5) in Rubyonrails Rails, published July 7, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.18%, the 90th percentile. Fixed in activerecord 4.0.7.
References
rhn.redhat.com/errata/RHSA-2014-0877.html
secunia.com/advisories/59971
openwall.com/lists/oss-security/2014/07/02/5
groups.google.com/forum/message/raw?msg=rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J
debian.org/security/2014/dsa-2982
Show 19 moreShow less
securityfocus.com/bid/68341
nvd.nist.gov/vuln/detail/CVE-2014-3483
github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2014-3483.yml
web.archive.org/web/20200228150648/http://www.securityfocus.com/bid/68341
security-tracker.debian.org/tracker/CVE-2014-3483
advisories.mageia.org/MGASA-2014-0303.html
weblog.rubyonrails.org/2014/5/6/Rails_3_2_18_4_0_5_and_4_1_1_have_been_released
bugs.mageia.org/show_bug.cgi?id=13659
access.redhat.com/errata/RHSA-2014:0877
bugzilla.redhat.com/show_bug.cgi?id=1114427
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0877.json
cve.org/CVERecord?id=CVE-2014-3483