Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-9t7a-muwx-zyee
Vulnerability ID VCID-9t7a-muwx-zyee
Aliases CVE-2016-6317
GHSA-pr3r-4wrp-r2pv
Summary Improper Access Control The Rails gem does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing `WHERE` clauses via a crafted request.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-284 Improper Access Control
CWE-476 NULL Pointer Dereference
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-20 Improper Input Validation
System Score Found at
cvssv3.1 7.5 http://rhn.redhat.com/errata/RHSA-2016-1855.html
generic_textual HIGH http://rhn.redhat.com/errata/RHSA-2016-1855.html
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-6317.json
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2016-6317
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2016-6317
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2016-6317
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2016-6317
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2016-6317
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2016-6317
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2016-6317
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2016-6317
epss 0.00381 https://api.first.org/data/v1/epss?cve=CVE-2016-6317
cvssv2 4.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-pr3r-4wrp-r2pv
cvssv3.1 7.5 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2016-6317.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2016-6317.yml
cvssv3 7.5 https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s
cvssv3.1 7.5 https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s
generic_textual HIGH https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s
cvssv3.1 7.5 https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA
generic_textual HIGH https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2016-6317
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2016-6317
cvssv3.1 7.5 http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released
generic_textual HIGH http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released
cvssv3.1 7.5 http://www.openwall.com/lists/oss-security/2016/08/11/4
generic_textual HIGH http://www.openwall.com/lists/oss-security/2016/08/11/4
Reference id Reference type URL
http://rhn.redhat.com/errata/RHSA-2016-1855.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-6317.json
https://api.first.org/data/v1/epss?cve=CVE-2016-6317
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6317
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2016-6317.yml
https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s
https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA
http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released
http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/
http://www.openwall.com/lists/oss-security/2016/08/11/4
1365017 https://bugzilla.redhat.com/show_bug.cgi?id=1365017
834154 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=834154
CVE-2016-6317 https://nvd.nist.gov/vuln/detail/CVE-2016-6317
GHSA-pr3r-4wrp-r2pv https://github.com/advisories/GHSA-pr3r-4wrp-r2pv
RHSA-2016:1855 https://access.redhat.com/errata/RHSA-2016:1855
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at http://rhn.redhat.com/errata/RHSA-2016-1855.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-6317.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2016-6317.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-6317
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at http://www.openwall.com/lists/oss-security/2016/08/11/4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.59406
EPSS Score 0.00381
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:47:05.878105+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/rails/CVE-2016-6317.yml 38.0.0