Rails ActiveRecord gem vulnerable to SQL injection (GHSA-xf96-32q2-9rw2)
Published: 2017-10-24T18:33:38Z
Aliases: CVE-2008-4094
Severity: HIGH · CWE: CWE-89

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) `:limit` and (2) `:offset` parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.

Affected packages:
package: ecosystem: RubyGems
name: activerecord
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.1.1