CWE Code: 200
Vulnerability Type: sql_injection
CVSS Score: 5.0
CWE Name:  Information Exposure
Summary: the authlogic gem for ruby on rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct cve-2012-6496 sql injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in secret_token.rb in an open-source product.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2013-01-04
Last Modified Date: 2019-08-08