onyx --cves cve-2013-0333
CVE-2013-0333
- score
- <0.1
- cvss
- 7.5
- epss
- 95.6%
- published
- 2013-01-30
- kev added
- —
- first seen
Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 contains a remote code execution and injection vulnerability caused by unsafe JSON to YAML conversion in lib/active_support/json/backends/yaml.rb, letting remote attackers execute arbitrary code, conduct SQL injection, or bypass authentication via crafted data that triggers unsafe decoding.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
NVD-CWE-Other
References 11
- https://puppet.com/security/cve/cve-2013-0333
- https://groups.google.com/group/rubyonrails-security/msg/52179af76915e518?dmode=source&output=gplain
- http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
- http://rhn.redhat.com/errata/RHSA-2013-0201.html
- http://rhn.redhat.com/errata/RHSA-2013-0202.html
- http://rhn.redhat.com/errata/RHSA-2013-0203.html
- http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/
- http://www.kb.cert.org/vuls/id/628463
- http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
- http://support.apple.com/kb/HT5784
- http://www.debian.org/security/2013/dsa-2613