CVE-2023-22794

State: Published
Severity: Not scored
Published: Feb 9, 2023
Updated: Aug 2, 2024
Reserved: Jan 6, 2023

Description

A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.

Scores

The record has no CVSS score.

Weaknesses

CWE-89 SQL Injection (CWE-89)

Affected Products

Product	Versions
https://github.com/rails/railsn/a	6.0.6.1, 6.1.7.1, 7.0.4.1Affected

References

https://discuss.rubyonrails.org/t/cve-2023-22794-sql-injection-vulnerability-via-activerecord-comments/82117
DSA-5372vendor-advisory
https://security.netapp.com/advisory/ntap-20240202-0008/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.