NVD

Id
39058  
Name
CVE-2013-3221  
Description
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-18  
Published
2013-04-21  
Modified Date
2013-04-25  
Seq
2013-3221  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
199890 39058 CVE-2013-3221 [oss-security] 20130207 Potential Query Manipulation with Common Rails Practises  View
199891 39058 CVE-2013-3221 [oss-security] 20130424 CVE-2013-3221 can also relate to Microsoft SQL Server and IBM DB2  View
199892 39058 CVE-2013-3221 http://pl.reddit.com/r/netsec/comments/17yajp/mysql_madness_and_rails/  View
199893 39058 CVE-2013-3221 http://www.phenoelit.org/blog/archives/2013/02/index.html  View
199894 39058 CVE-2013-3221 https://gist.github.com/dakull/5442275  View
199895 39058 CVE-2013-3221 [rubyonrails-security] 20130207 Potential Query Manipulation with Common Rails Practises  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
20870 JVNDB-2013-002445 Ruby on Rails の Active Record コンポーネントにおけるデータ型インジェクション攻撃を実行される脆弱性 Ruby on Rails の Active Record コンポーネントは、入力値と列に格納された値を比較する間、データベースの列に宣言されたデータ型が使用されているかどうか確認しないため、Ruby on Rails アプリケーションに対してデータ型インジェクション (data-type interaction) 攻撃を実行される脆弱性が存在します。 CVE-2013-3221 63163 CVE-2013-3221 39058 6.4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-002445.html 2013-04-22 2013-04-23 View