Administrate
Approved changes feed: RSS · Atom
cpe:2.3:a:thoughtbot:administrate:*:*:*:*:*:ruby:*:*
part: a version: * update: *
| Vendor | Thoughtbot (d1b410e5-07b5-53a1-8ffa-f51c831deea8) |
|---|---|
| Product | Administrate (e2aee889-49bb-5195-9a69-979db8b6afcf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | ruby |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-5257 |
vulnerable | 2026-06-08 05:26:41.614845 |
Sort order SQL injection in Administrate
HIGH (7.7)
In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the `direction` parameter and bypass ActiveRecord SQL protections. Whilst this does have a high-impact, to exploit this you need access to the Administrate dashboards, which we would expect to be behind authentication. This is patched in wersion 0.13.0.
Published: 2020-03-13T21:05:15.000Z
Updated: 2024-08-04T08:22:09.077Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-3098 |
vulnerable | 2026-06-08 05:07:44.455040 |
Details available
Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.
Published: 2022-08-05T15:22:14.000Z
Updated: 2024-08-05T23:47:56.988Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.