CVE-2013-1756

2014-06-0919:55:00

CWE-94

[email protected]

web.nvd.nist.gov

cve-2013-1756

dragonfly gem

ruby

ruby on rails

remote code execution

vulnerability

7.7 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.328 Low

EPSS

Percentile

97.0%

JSON

The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.

CPENameOperatorVersion
mark_evans:dragonfly_gemmark evans dragonfly gemeq0.7.0
mark_evans:dragonfly_gemmark evans dragonfly gemeq0.7.1
mark_evans:dragonfly_gemmark evans dragonfly gemeq0.7.2
mark_evans:dragonfly_gemmark evans dragonfly gemeq0.7.3
mark_evans:dragonfly_gemmark evans dragonfly gemeq0.7.4
mark_evans:dragonfly_gemmark evans dragonfly gemeq0.7.5
mark_evans:dragonfly_gemmark evans dragonfly gemeq0.7.6
mark_evans:dragonfly_gemmark evans dragonfly gemeq0.7.7
mark_evans:dragonfly_gemmark evans dragonfly gemeq0.8.0
mark_evans:dragonfly_gemmark evans dragonfly gemeq0.8.1

CPE	Name	Operator	Version
mark_evans:dragonfly_gem	mark evans dragonfly gem	eq	0.7.0
mark_evans:dragonfly_gem	mark evans dragonfly gem	eq	0.7.1
mark_evans:dragonfly_gem	mark evans dragonfly gem	eq	0.7.2
mark_evans:dragonfly_gem	mark evans dragonfly gem	eq	0.7.3
mark_evans:dragonfly_gem	mark evans dragonfly gem	eq	0.7.4
mark_evans:dragonfly_gem	mark evans dragonfly gem	eq	0.7.5
mark_evans:dragonfly_gem	mark evans dragonfly gem	eq	0.7.6
mark_evans:dragonfly_gem	mark evans dragonfly gem	eq	0.7.7
mark_evans:dragonfly_gem	mark evans dragonfly gem	eq	0.8.0
mark_evans:dragonfly_gem	mark evans dragonfly gem	eq	0.8.1