NVD

Id
36527  
Name
CVE-2013-0156  
Description
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-01-13  
Modified Date
2016-12-07  
Seq
2013-0156  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
186511 36527 CVE-2013-0156 http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A  View
186512 36527 CVE-2013-0156 APPLE-SA-2013-03-14-1  View
186513 36527 CVE-2013-0156 RHSA-2013:0153  View
186514 36527 CVE-2013-0156 RHSA-2013:0154  View
186515 36527 CVE-2013-0156 RHSA-2013:0155  View
186516 36527 CVE-2013-0156 http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/  View
186517 36527 CVE-2013-0156 DSA-2604  View
186518 36527 CVE-2013-0156 http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html  View
186519 36527 CVE-2013-0156 http://www.insinuator.net/2013/01/rails-yaml/  View
186520 36527 CVE-2013-0156 VU#380039  View
186521 36527 CVE-2013-0156 VU#628463  View
186522 36527 CVE-2013-0156 https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156  View
186523 36527 CVE-2013-0156 [rubyonrails-security] 20130108 Multiple vulnerabilities in parameter parsing in Action Pack (CVE-2013-0156)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19445 JVNDB-2013-001019 Ruby on Rails に複数の脆弱性 Ruby on Rails には、複数の脆弱性が存在します。 CVE-2013-0156 60098 CVE-2013-0156 36527 7.5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001019.html 2013-01-09 2014-03-28 View