Threats tagged 'ghsa-q5w2-57qp-493f'

A Ruby object-document mapper fails to apply automatic field-level encryption to certain fields when using class inheritance in the data model. As a result, values intended for encryption are stored in readable form in the database without any error or warning. This allows a database account with read-only access to the application's collections, but no access to the encryption key store, to obtain sensitive plaintext data.