NVD

Id
36679  
Name
CVE-2013-0333  
Description
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-01-30  
Modified Date
2013-06-05  
Seq
2013-0333  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
187448 36679 CVE-2013-0333 APPLE-SA-2013-06-04-1  View
187449 36679 CVE-2013-0333 APPLE-SA-2013-03-14-1  View
187450 36679 CVE-2013-0333 RHSA-2013:0201  View
187451 36679 CVE-2013-0333 RHSA-2013:0202  View
187452 36679 CVE-2013-0333 RHSA-2013:0203  View
187453 36679 CVE-2013-0333 http://support.apple.com/kb/HT5784  View
187454 36679 CVE-2013-0333 http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/  View
187455 36679 CVE-2013-0333 DSA-2613  View
187456 36679 CVE-2013-0333 VU#628463  View
187457 36679 CVE-2013-0333 [rubyonrails-security] 20130129 Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19745 JVNDB-2013-001320 Ruby on Rails における任意のコードを実行される脆弱性 Ruby on Rails の lib/active_support/json/backends/yaml.rb は、YAML パーサによるプロセスにおいて、JSON データから YAML データへ適切に変換しないため、任意のコードを実行される、SQL インジェクション攻撃を実行される、または認証を回避される脆弱性が存在します。 CVE-2013-0333 60275 CVE-2013-0333 36679 7.5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001320.html 2013-01-28 2013-06-07 View