Active Record subject to strong parameters protection bypass (GHSA-9rf5-jm6f-2fmm)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2014-3514
Severity: HIGH · CWE: CWE-284

`activerecord/lib/active_record/relation/query_methods.rb` in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes `create_with` calls.

Affected packages:
package: ecosystem: RubyGems
name: activerecord
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.0.9
package: ecosystem: RubyGems
name: activerecord
ranges: type: ECOSYSTEM
events: introduced: 4.1.0
fixed: 4.1.5