{"id":"CVE-2014-3483","aliases":["DEBIAN-CVE-2014-3483","DSA-2982-1","EUVD-2017-0298","GHSA-r8fh-hq2p-7qhq","MGASA-2014-0303","RHSA-2014:0877"],"status":"published","title":"Active Record contains SQL Injection via improper range quoting","description":"SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04181,"percentile":0.90986,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2014-07-07T10:00:00Z","modified":"2026-10-23T15:47:29Z","fixes":[{"ecosystem":"RubyGems","package":"activerecord","fixed_in":["4.0.7","4.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2:4.1.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2:4.1.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2:4.1.4-1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"ror40-rubygem-activerecord","fixed_in":["1:4.0.2-2.2.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"ror40-rubygem-activerecord-doc","fixed_in":["1:4.0.2-2.2.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"ror40-rubygem-activerecord","fixed_in":["1:4.0.2-2.2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"ror40-rubygem-activerecord-doc","fixed_in":["1:4.0.2-2.2.el7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.7"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.4-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"ruby-activerecord-3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6-5+deb7u1"}]}],"versions":["3.2.6-5"],"bundled":2},{"source":"osv","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.7"}]}],"versions":["4.0.0","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4.0.6.rc2","4.0.6.rc3"]},{"source":"osv","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.3"}]}],"versions":["4.1.0","4.1.1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3"]},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-actionmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-activemodel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-railties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"ror40-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-2.2.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"ror40-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-2.2.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"ror40-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-2.2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"ror40-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-2.2.el7"}]}]}],"products":[{"vendor":"rubyonrails","product":"rails"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2014-0877.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/59971","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://openwall.com/lists/oss-security/2014/07/02/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/60214","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-2982","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/68341","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3483","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2014-3483.yml","tags":["web"]},{"url":"https://web.archive.org/web/20200228150648/http://www.securityfocus.com/bid/68341","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r8fh-hq2p-7qhq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3483","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0303.html","tags":["advisory"]},{"url":"http://weblog.rubyonrails.org/2014/5/6/Rails_3_2_18_4_0_5_and_4_1_1_have_been_released/","tags":["web"]},{"url":"http://weblog.rubyonrails.org/2014/6/26/Rails-4-1-2-and-4-0-6-has-been-released/","tags":["web"]},{"url":"http://weblog.rubyonrails.org/2014/7/2/Rails_3_2_19_4_0_7_and_4_1_3_have_been_released/","tags":["web"]},{"url":"http://weblog.rubyonrails.org/2014/7/2/Rails_4_0_8_and_4_1_4_have_been_released/","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13659","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13339","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0877","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1114427","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0877.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3483","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3483","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-3483","description":"SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.","status":"published","published":"2014-07-07T10:00:00Z","modified":"2024-08-06T10:43:06.187Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2017-0298","description":"SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.","status":"published","published":"2014-07-07T10:00:00Z","modified":"2024-08-06T10:43:06Z","updated_at":"2026-11-03T01:57:10.446744Z"}],"ghsa":[{"id":"GHSA-r8fh-hq2p-7qhq","title":"Active Record contains SQL Injection via improper range quoting","description":"SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2023-11-10T05:01:22Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:18.40412Z"}],"nvd":[{"id":"CVE-2014-3483","description":"SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.","status":"published","published":"2014-07-07T11:01:30.573Z","modified":"2026-06-17T00:08:17Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:02:54.827864Z"}],"osv":[{"id":"CVE-2014-3483","description":"SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.","status":"published","published":"2014-07-07T11:01:30Z","modified":"2026-04-16T06:26:18.643862523Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3483","description":"SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.","status":"published","published":"2014-07-07T11:01:30.573Z","modified":"2026-10-23T15:47:29.318950638Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DSA-2982-1","title":"ruby-activerecord-3.2 - security update","status":"published","published":"2014-07-19T00:00:00Z","modified":"2026-03-09T01:22:53.038845Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"GHSA-r8fh-hq2p-7qhq","title":"Active Record contains SQL Injection via improper range quoting","description":"SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2024-11-29T05:28:07.785614Z","cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"MGASA-2014-0303","title":"Updated ruby-actionpack packages fix security issues","description":"Updated ruby-actionpack and ruby-activerecord packages fix security\nvulnerabilities:\n\nDirectory traversal vulnerability in actionpack/lib/abstract_controller/base.rb\nin the implicit-render implementation in Ruby on Rails before 4.0.5, when\ncertain route globbing configurations are enabled, allows remote attackers to\nread arbitrary files via a crafted request (CVE-2014-0130).\n\nPostgreSQL supports a number of unique data types which are not present in\nother supported databases.  A bug in the SQL quoting code in ActiveRecord in\nRuby on Rails before 4.0.7 can allow an attacker to inject arbitrary SQL using\ncarefully crafted values (CVE-2014-3483).\n\nThe associated Ruby on Rails packages have been updated to version 4.0.8, to\naddress these and other issues.\n","status":"published","published":"2014-07-26T13:09:43Z","modified":"2026-04-16T06:25:06.797705834Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"RHSA-2014:0877","title":"Red Hat Security Advisory: ror40-rubygem-activerecord security update","status":"published","published":"2024-09-13T08:54:00Z","modified":"2026-06-29T10:07:01Z","updated_at":"2026-11-02T15:53:02.532052Z"}]}}