CVE-2023-22794 - CVE House

Back to Database

Status published Unknown CVE-2023-22794

A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to...

0 CVSS

Vulnerability Description

A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-22794

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from n/a

View All →

Versions of the package jsondiffpatch before 0.7.2 are vulnerable to...

RemoteClinic profile.php sql injection

Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgery

RemoteClinic edit-my-profile.php unrestricted upload

RemoteClinic edit-patient.php information disclosure

Affected Vendor

n/a

View all reports →

Affected Software

https://github.com/rails/rails

Vulnerable Versions:

6.0.6.1, 6.1.7.1, 7.0.4.1

Timeline

Official Publish: February 9th, 2023

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1213.006 Databases

T1485 Data Destruction