Sort order SQL injection in Administrate
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.
Summary
In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the `direction` parameter and bypass ActiveRecord SQL protections. Whilst this does have a high-impact, to exploit this you need access to the Administrate dashboards, which we would expect to be behind authentication. This is patched in wersion 0.13.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| thoughtbot | administrate | before 0.13.0 | 0.13.0 | Patch available | CNA |
| — | administrate (RubyGems) | before 0.13.0 | 0.13.0 | Patch available | GHSA-2p5p-m353-833w |
- administrate Vendorthoughtbot Affected before 0.13.0 Fixed in 0.13.0 Patch available CNA
- administrate (RubyGems) Vendor— Affected before 0.13.0 Fixed in 0.13.0 Patch available GHSA-2p5p-m353-833w
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:thoughtbot:administrate:*:*:*:*:*:ruby:*:* | before 0.13.0 | Vulnerable | thoughtbot |
- cpe:2.3:a:thoughtbot:administrate:*:*:*:*:*:ruby:*:* Versions before 0.13.0 Vulnerable ·thoughtbot
Remediation
- Fix · CNA administrate (thoughtbot) Fixed in 0.13.0
- Fix · GHSA-2p5p-m353-833w administrate (RubyGems) Fixed in 0.13.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5257
- 2026-10-03 Alias added: GHSA-2p5p-m353-833w
References
Advisory 3
More thoughtbot Administrate vulnerabilities
- TI-2016-02597 Cross-site request forgery in administrate CVSS 3.1MEDIUM 5.4
Sources
- CVE-2020-5257 · CVE Program
- CVE-2020-5257 · NVD
- FIRST EPSS
- GHSA-2p5p-m353-833w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences