CVSS 3 Base Score: Posted On: December 26, 2012Assessed Risk Level: None Due to the way dynamic finders in Active Record extract options from method parameters, a method parameter can mistakenly be used as a scope. Carefully crafted requests can use the scope to inject arbitrary SQL. This vulnerability affects Puppet Dashboard, which is installed on the console in Puppet Enterprise. It also affects ActiveRecord, which is used in stored configs on the master in Puppet Enterprise. All users running an affected release should upgrade as soon as possible. Impacted code passes user provided data to a dynamic finder like this: Post.find_by_id(params[:id]) More information can be found in the following post: https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFMStatus:Affected software versions:Resolved in:Hotfixes available for Puppet Enterprise 1.2.5 and 2.7.0Hotfixeshttp://puppetlabs.com/security/cve/cve-2012-5664/hotfixes/← Back to CVE Listings
