CVE-2014-3514

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 4.0.x through 4.0.8 Ruby on Rails versions 4.1.x through 4.1.4

Description The issue allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create with calls. This is related to the activerecord/lib/active record/relation/query methods.rb file in Active Record.

Recommendations For Ruby on Rails versions 4.0.x through 4.0.8, update to version 4.0.9 or later. For Ruby on Rails versions 4.1.x through 4.1.4, update to version 4.1.5 or later.