CVE-2013-3221: Rubyonrails Rails

Medium severity, CVSS 6.4. EPSS: 2% chance of exploitation in the next 30 days.

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.

Affected products

• Rubyonrails Rails: version 2.3.0 only; version 2.3.1 only; version 2.3.2 only; version 2.3.3 only; version 2.3.4 only; version 2.3.9 only; …
• Rubyonrails Ruby On Rails: version 3.0.4 only

Published 2013-04-22. Last modified 2026-06-16.