CVE-2014-3514: activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0...

Security readout for executives and security teams

This is an older Ruby on Rails issue where some applications could lose intended parameter protection when using create_with. If affected code accepts crafted user input, attackers may set fields the application expected to block. Business impact depends on what protected fields exist in the affected workflow. Exposure is likely limited to Rails 4.0.x or 4.1.x applications below the fixed versions that use ActiveRecord create_with with user-influenced input. Applications not using create_with in affected flows appear less likely to be exposed based on the provided description. Prioritize if legacy Rails applications handle account, payment, authorization, or administrative data. For exposed workflows, this can undermine application-level safeguards. If no affected Rails versions or create_with usage exist, urgency is lower. Mitigation focus: Upgrade Rails 4.0.x to 4.0.9 or later.; Upgrade Rails 4.1.x to 4.1.5 or later.; Review create_with usage for user-controlled input..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.