CVE-2011-2930: activerecord vulnerable to SQL Injection

October 24, 2017 (updated November 3, 2025)

Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.

References

bugzilla.redhat.com/show_bug.cgi?id=731438
github.com/advisories/GHSA-h6w6-xmqv-7q78
github.com/rails/rails
github.com/rails/rails/commit/8a39f411dc3c806422785b1f4d5c7c9d58e4bf85
github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2011-2930.yml
nvd.nist.gov/vuln/detail/CVE-2011-2930

Code Behaviors & Features

Detect and mitigate CVE-2011-2930 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →