CVE-2017-17920

HIGH

Ruby on Rails < 5.1.4 - SQL Injection via Reorder Method Name Parameter

Title source: llm
STIX 2.1

Description

SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input

References (1)

Core 1
Core References

Scores

CVSS v3 8.1
EPSS 0.0152
EPSS Percentile 71.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
rubyonrails/ruby_on_rails < 5.1.4
Published Dec 29, 2017
Tracked Since Feb 18, 2026