CVE-2020-5257-expected.json

[
  {
    "advisory_id": "gems/CVE-2020-5257",
    "aliases": [
      "CVE-2020-5257",
      "GHSA-2p5p-m353-833w"
    ],
    "summary": "Sort order SQL injection via `direction` parameter in administrate\nIn Administrate (rubygem) before version 0.13.0, when sorting by attributes\non a dashboard, the direction parameter was not validated before being\ninterpolated into the SQL query.\n\nThis could present a SQL injection if the attacker were able to modify the\ndirection parameter and bypass ActiveRecord SQL protections.\n\nWhilst this does have a high-impact, to exploit this you need access to the\nAdministrate dashboards, which should generally be behind authentication.",
    "affected_packages": [
      {
        "package": {
          "type": "gem",
          "namespace": "",
          "name": "administrate",
          "version": "",
          "qualifiers": "",
          "subpath": ""
        },
        "affected_version_range": null,
        "fixed_version_range": "vers:gem/>=0.13.0",
        "introduced_by_commit_patches": [],
        "fixed_by_commit_patches": []
      }
    ],
    "references_v2": [
      {
        "reference_id": "",
        "reference_type": "",
        "url": "https://github.com/advisories/GHSA-2p5p-m353-833w"
      }
    ],
    "patches": [],
    "severities": [
      {
        "system": "cvssv3",
        "value": "7.7",
        "scoring_elements": ""
      }
    ],
    "date_published": "2020-03-14T00:00:00+00:00",
    "weaknesses": [],
    "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/CVE-2020-5257.yml"
  }
]