NVD

Id
36526  
Name
CVE-2013-0155  
Description
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-18  
Published
2013-01-13  
Modified Date
2014-01-13  
Seq
2013-0155  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
186500 36526 CVE-2013-0155 http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A  View
186501 36526 CVE-2013-0155 APPLE-SA-2013-06-04-1  View
186502 36526 CVE-2013-0155 openSUSE-SU-2013:1904  View
186503 36526 CVE-2013-0155 openSUSE-SU-2013:1906  View
186504 36526 CVE-2013-0155 openSUSE-SU-2013:1907  View
186505 36526 CVE-2013-0155 openSUSE-SU-2014:0009  View
186506 36526 CVE-2013-0155 RHSA-2013:0154  View
186507 36526 CVE-2013-0155 RHSA-2013:0155  View
186508 36526 CVE-2013-0155 http://support.apple.com/kb/HT5784  View
186509 36526 CVE-2013-0155 DSA-2609  View
186510 36526 CVE-2013-0155 [rubyonrails-security] 20130108 Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0155)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19483 JVNDB-2013-001057 Ruby on Rails におけるデータベースのクエリ制限を回避される脆弱性 Ruby on Rails は、Active Record コンポーネントと JSON の実装におけるパラメータ処理の違いを適切に配慮しないため、データベースのクエリ制限を回避され、NULL チェックを実行される、または WHERE 句の削除を誘発される脆弱性が存在します。 CVE-2013-0155 60097 CVE-2013-0155 36526 6.4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001057.html 2013-01-08 2013-06-07 View