← Retour aux CVEs
CVE-2022-32224
CRITICAL9.8
Description
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.
Details CVE
Score CVSS v3.19.8
SeveriteCRITICAL
Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vecteur d'attaqueNETWORK
ComplexiteLOW
Privileges requisNONE
Interaction utilisateurNONE
Publie12/5/2022
Derniere modification4/24/2025
Sourcenvd
Observations honeypot0
Produits affectes
activerecord_project:activerecord
Faiblesses (CWE)
CWE-502CWE-502
References
https://github.com/advisories/GHSA-3hhc-qp5v-9p2j(support@hackerone.com)
https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U(support@hackerone.com)
https://github.com/advisories/GHSA-3hhc-qp5v-9p2j(af854a3a-2127-422b-91ae-364da2661108)
https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U(af854a3a-2127-422b-91ae-364da2661108)
Correlations IOC
Aucune correlation enregistree
This product uses data from the NVD API but is not endorsed or certified by the NVD.