CVE-2011-0448
activerecord vulnerable to SQL Injection
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
Exploit likelihood
What each source reports
NVD Score used
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
- Record
CVE-2011-0448- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE ListNo score
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
- Record
CVE-2011-0448- Updated
- 2026-11-02
EUVDEUVD-2017-0265No score
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
- Record
EUVD-2017-0265- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jmm9-2p29-vh2wNo score
activerecord vulnerable to SQL Injection
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
- Record
GHSA-jmm9-2p29-vh2w- Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-jmm9-2p29-vh2wNo score
activerecord vulnerable to SQL Injection
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
- Record
GHSA-jmm9-2p29-vh2w- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecordRubyGems | 3.0.0 up to 3.0.4 | 3.0.4 |
activerecordRubyGems | 3.0.0 up to 3.0.4, plus listed versions 3.0.13.0.23.0.33.0.4.rc1 | 3.0.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-0448 is a high vulnerability (CVSS 7.5) in Rubyonrails Rails, published February 21, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.17%, the 82nd percentile. Fixed in activerecord 3.0.4.
References
groups.google.com/group/rubyonrails-security/msg/4e19864cf6ad40ad?dmode=source&output=gplain
weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
securitytracker.com/id?1025063
lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
secunia.com/advisories/43278
vupen.com/english/advisories/2011/0877
Show 6 moreShow less
github.com/rails/rails/commit/354da43ab0a10b3b7b3f9cb0619aa562c3be8474
nvd.nist.gov/vuln/detail/CVE-2011-0448
web.archive.org/web/20201220214809/http://securitytracker.com/id?1025063