onyx --cves cve-2013-0155
CVE-2013-0155
- score
- <0.1
- cvss
- 6.4
- epss
- 8.2%
- published
- 2013-01-13
- kev added
- —
- first seen
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 contain a SQL injection caused by improper parameter handling between Active Record and JSON, letting remote attackers bypass database restrictions and manipulate queries via crafted requests, exploit requires sending specially crafted requests.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 12
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
- http://rhn.redhat.com/errata/RHSA-2013-0155.html
- http://support.apple.com/kb/HT5784
- http://www.debian.org/security/2013/dsa-2609
- https://groups.google.com/group/rubyonrails-security/msg/bc6f13dafe130ee9?dmode=source&output=gplain
- https://puppet.com/security/cve/cve-2013-0155
- http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
- http://rhn.redhat.com/errata/RHSA-2013-0154.html
- http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A