CVE Vulnerability

CVE-2022-32224

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U Exploit Mailing List
https://github.com/advisories/GHSA-3hhc-qp5v-9p2j Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*
cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*
cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*
cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*
Information

Published : 2022-12-05 10:15

Updated : 2022-12-08 01:20

NVD link : CVE-2022-32224

Mitre link : CVE-2022-32224

Products Affected
No products.
CWE
CWE-502

Deserialization of Untrusted Data