CVE-2013-0155

2013-01-1322:55:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2013-0155

ruby

rails

security

vulnerability

cve

parameter handling

active record

json

database-query restrictions

null checks

where clauses

remote attack

nvd

7.6 High

AI Score

Confidence

High

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.004 Low

EPSS

Percentile

72.4%

JSON

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain “[nil]” values, a related issue to CVE-2012-2660 and CVE-2012-2694.

CPENameOperatorVersion
rubyonrails:ruby_on_railsrubyonrails ruby on railslt3.0.19
rubyonrails:ruby_on_railsrubyonrails ruby on railslt3.1.10
rubyonrails:railsrubyonrails railslt3.2.11
debian:debian_linuxdebian debian linuxeq6.0

CPE	Name	Operator	Version
rubyonrails:ruby_on_rails	rubyonrails ruby on rails	lt	3.0.19
rubyonrails:ruby_on_rails	rubyonrails ruby on rails	lt	3.1.10
rubyonrails:rails	rubyonrails rails	lt	3.2.11
debian:debian_linux	debian debian linux	eq	6.0