PT-2022-23056 · Unknown · Update By Case

Camilova · Published 2022-08-11 · Updated 2022-08-16 · CVE-2022-35956

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions update by case gem versions prior to 0.1.3

Description The issue concerns a SQL injection vulnerability due to the use of custom, unsanitized SQL strings in the update by case gem. This vulnerability allows for potential SQL injection attacks. The gem has been updated to use Arel for constructing SQL statements, which sanitizes the input and prevents SQL injection.

Recommendations For versions prior to 0.1.3, upgrade to version 0.1.3 or later, which uses Arel to construct the resulting SQL statement with sanitized SQL.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-35956

GHSA-33WH-W4M7-C6R8

Affected Products

Update By Case

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35956.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/update_by_case/CVE-2022-35956.yml · Exploit
• https://osv.dev/vulnerability/GHSA-33wh-w4m7-c6r8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35956 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35956 · Vendor Advisory
• https://github.com/camilova/activerecord-update-by-case · Note
• https://github.com/camilova/activerecord-update-by-case/security/advisories/GHSA-33wh-w4m7-c6r8 · Note
• https://github.com/camilova/activerecord-update-by-case/releases/tag/v0.1.3-stable · Note