GHSA-33wh-w4m7-c6r8

Suggest an improvement
Source
https://github.com/advisories/GHSA-33wh-w4m7-c6r8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-33wh-w4m7-c6r8/GHSA-33wh-w4m7-c6r8.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-33wh-w4m7-c6r8
Aliases
Published
2022-08-11T21:18:31Z
Modified
2023-11-01T04:59:25.043137Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L CVSS Calculator
Summary
update_by_case before 0.1.3 can be vulnerable to sql injection
Details

Before version 0.1.3 update_by_case gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgrade to version >= 0.1.3 that uses Arel instead to construct the resulting sql statement, with sanitized sql.

Database specific
{
    "nvd_published_at": "2022-08-12T21:15:00Z",
    "github_reviewed_at": "2022-08-11T21:18:31Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-89"
    ]
}
References

Affected packages

RubyGems / update_by_case

Package

Name
update_by_case
Purl
pkg:gem/update_by_case

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.1.3