Read the docs

thoughtbot

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

thoughtbot records in CISA KEV

No thoughtbot vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Administrate 2 records LOW Paperclip 2 records MEDIUM Clearance 1 record LOW Cocaine 1 record LOW

Records

2 records in Administrate · all components

TI-2020-04313 CVE-2020-5257 · GHSA-2p5p-m353-833w

Sort order SQL injection in Administrate

Priority LOW 37

In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.009 Published 2020-03-13 Fixed in 0.13.0 CWE-943
TI-2016-02597 CVE-2016-3098 · GHSA-cc8c-26rj-v2vx

Cross-site request forgery in administrate

Priority LOW 25

Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00369 Published 2022-08-05 Fixed in 0.1.5 CWE-352
Open these records in search →