On: Rails 3.2.13, 3.1.12, and 2.3.18 have been released

[grey-area]

Yep, kudos to tenderlove and others for putting in the work to make this framework secure by default. The changes in Rails 4 should help more with this as well (strong parameters in particular).