Administrate
Approved changes feed: RSS · Atom
cpe:2.3:a:thoughtbot:administrate:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Thoughtbot (d1b410e5-07b5-53a1-8ffa-f51c831deea8) |
|---|---|
| Product | Administrate (e2aee889-49bb-5195-9a69-979db8b6afcf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:gem/administrate |
purl2cpe | 2026-06-01 10:12:24.811279 |
pkg:github/thoughtbot/administrate |
purl2cpe | 2026-06-01 10:12:24.811282 |
pkg:sourceforge/administrate.mirror |
purl2cpe | 2026-06-01 10:12:24.811285 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-5257 |
vulnerable | 2026-06-08 05:26:41.614002 |
Sort order SQL injection in Administrate
HIGH (7.7)
In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the `direction` parameter and bypass ActiveRecord SQL protections. Whilst this does have a high-impact, to exploit this you need access to the Administrate dashboards, which we would expect to be behind authentication. This is patched in wersion 0.13.0.
Published: 2020-03-13T21:05:15.000Z
Updated: 2024-08-04T08:22:09.077Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.