CVE ID:	CVE-2012-2660
Description:	actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.
Test IDs:	1.3.6.1.4.1.25623.1.0.71520   1.3.6.1.4.1.25623.1.0.864447
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2012-2660 https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain RedHat Security Advisories: RHSA-2013:0154 http://rhn.redhat.com/errata/RHSA-2013-0154.html SuSE Security Announcement: SUSE-SU-2012:1012 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html SuSE Security Announcement: SUSE-SU-2012:1014 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html SuSE Security Announcement: SUSE-SU-2012:1015 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html SuSE Security Announcement: openSUSE-SU-2012:0978 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html SuSE Security Announcement: openSUSE-SU-2012:1066 (Google Search) http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html