Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-a5js-1u9t-bfan
Vulnerability ID VCID-a5js-1u9t-bfan
Aliases CVE-2014-3514
GHSA-9rf5-jm6f-2fmm
Summary Active Record subject to strong parameters protection bypass `activerecord/lib/active_record/relation/query_methods.rb` in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes `create_with` calls.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-284 Improper Access Control
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-264 Permissions, Privileges, and Access Controls
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual HIGH http://openwall.com/lists/oss-security/2014/08/18/10
generic_textual HIGH http://rhn.redhat.com/errata/RHSA-2014-1102.html
epss 0.00331 https://api.first.org/data/v1/epss?cve=CVE-2014-3514
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-9rf5-jm6f-2fmm
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2014-3514.yml
generic_textual HIGH https://groups.google.com/forum/message/raw?msg=rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ
generic_textual HIGH https://groups.google.com/forum/#!msg/rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2014-3514
Reference id Reference type URL
http://openwall.com/lists/oss-security/2014/08/18/10
http://rhn.redhat.com/errata/RHSA-2014-1102.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-3514.json
https://api.first.org/data/v1/epss?cve=CVE-2014-3514
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3514
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2014-3514.yml
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ
https://groups.google.com/forum/#!msg/rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ
https://groups.google.com/forum/#!topic/ruby-security-ann/M4chq5Sb540
https://nvd.nist.gov/vuln/detail/CVE-2014-3514
1131240 https://bugzilla.redhat.com/show_bug.cgi?id=1131240
GHSA-9rf5-jm6f-2fmm https://github.com/advisories/GHSA-9rf5-jm6f-2fmm
RHSA-2014:1102 https://access.redhat.com/errata/RHSA-2014:1102
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.56253
EPSS Score 0.00331
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T08:57:02.628067+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-9rf5-jm6f-2fmm/GHSA-9rf5-jm6f-2fmm.json 38.6.0