CVE-2017-17919

HIGH

Ruby on Rails < 5.1.4 - SQL Injection via Order Method

Title source: llm
STIX 2.1

Description

SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input

References (1)

Core 1
Core References

Scores

CVSS v3 8.1
EPSS 0.0152
EPSS Percentile 71.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
rubyonrails/ruby_on_rails < 5.1.4
Published Dec 29, 2017
Tracked Since Feb 18, 2026