Every CVESearch/Get API key

CVE-2014-0080

Array data injection vulnerability in activerecord

6.8 MediumFix available

CVE-2014-0080 is a medium vulnerability (CVSS 6.8) in Rubyonrails Rails, published February 20, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 70th percentile. Fixed in activerecord 4.0.3.

What does this mean?
Severity
6.8 MediumCVSS 2.0, NVD
Exploit chance
1.27%EPSS, 70th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
4.0.3activerecord +10 more

Description

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.

Exploit likelihood

1.27%Up 0.2 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
activerecord
RubyGems
4.0.0 up to 4.0.3
4.0.3
activerecord
RubyGems
4.1.0.beta1 to 4.1.0.beta1
4.1.0.beta2
activerecord
RubyGems
4.0.0 up to 4.0.3, plus listed versions
4.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc44.0.2
4.0.3
activerecord
RubyGems
4.1.0.beta1 up to 4.1.0.beta2
4.1.0.beta2
ruby-actionmailer
Mageia:4
From an advisory covering 2 CVEs
before 4.0.3-1.mga4
4.0.3-1.mga4
ruby-actionpack
Mageia:4
From an advisory covering 2 CVEs
before 4.0.3-1.mga4
4.0.3-1.mga4
ruby-activemodel
Mageia:4
From an advisory covering 2 CVEs
before 4.0.3-1.mga4
4.0.3-1.mga4
ruby-activerecord
Mageia:4
From an advisory covering 2 CVEs
before 4.0.3-1.mga4
4.0.3-1.mga4
ruby-activesupport
Mageia:4
From an advisory covering 2 CVEs
before 4.0.3-1.mga4
4.0.3-1.mga4
ruby-rails
Mageia:4
From an advisory covering 2 CVEs
before 4.0.3-1.mga4
4.0.3-1.mga4
ruby-railties
Mageia:4
From an advisory covering 2 CVEs
before 4.0.3-1.mga4
4.0.3-1.mga4

What each source reports

NVD Score used6.8

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.

Record
CVE-2014-0080
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-89
Updated
2026-11-02
CVE ListNo score

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.

Record
CVE-2014-0080
Updated
2026-11-02
EUVDEUVD-2017-0254No score

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.

Record
EUVD-2017-0254
Updated
2026-11-03
GitHub AdvisoriesGHSA-hqf9-rc9j-5fmjNo score

Array data injection vulnerability in activerecord

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.

Record
GHSA-hqf9-rc9j-5fmj
Weakness
CWE-89
Updated
2026-11-02
OSVGHSA-hqf9-rc9j-5fmjNo score

Array data injection vulnerability in activerecord

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.

Record
GHSA-hqf9-rc9j-5fmj
Weakness
CWE-89
Updated
2026-11-02
OSVMGASA-2014-0191No score

Updated ruby-rails and associated packages fix multiple vulnerabilities

Updated ruby-activerecord and ruby-actionpack packages fix security vulnerabilities:

There is a data injection vulnerability in Active Record. Specially crafted strings can be used to save data in PostgreSQL array columns that may not be intended (CVE-2014-0080).

There is an XSS vulnerability in the number_to_currency, number_to_percentage and number_to_human helpers in Ruby on Rails (CVE-2014-0081).

The associated packages have been updated to version 4.0.3 to fix these issues.

Record
MGASA-2014-0191
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 6 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open