CVE-2013-1856
Severity Score
5.8
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.
El backend ActiveSupport::XmlMini_JDOM en lib/active_support/xml_mini/jdom.rb en el componente Active Support en Ruby on Rails v3.0.x y 3.1.x anterior a v3.1.12 y v3.2.x anterior a v3.2.13, cuando se usa JRuby, no restringe adecuadamente las capacidades del validador XML, lo que permite a atacantes remotos leer archivos de su elección o provocar una denegación de servicio (consumo de recursos) a través de vectores que involucran (1) una TDT externa o (2) una declaración de entidad externa junto con una referencia a una entidad.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2013-02-19 CVE Reserved
- 2013-03-19 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://support.apple.com/kb/HT5784 | X_refsource_confirm |
|
| http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released | X_refsource_confirm | |
| https://groups.google.com/group/rubyonrails-security/msg/6c2482d4ed1545e6?dmode=source&output=gplain | Mailing List |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html | 2019-08-08 | |
| http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html | 2019-08-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | beta1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc4 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc5 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc6 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc7 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.0 Search vendor "Rubyonrails" for product "Rails" and version "3.1.0" | rc8 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.1 Search vendor "Rubyonrails" for product "Rails" and version "3.1.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.1 Search vendor "Rubyonrails" for product "Rails" and version "3.1.1" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.1 Search vendor "Rubyonrails" for product "Rails" and version "3.1.1" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.1 Search vendor "Rubyonrails" for product "Rails" and version "3.1.1" | rc3 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.2 Search vendor "Rubyonrails" for product "Rails" and version "3.1.2" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.2 Search vendor "Rubyonrails" for product "Rails" and version "3.1.2" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.2 Search vendor "Rubyonrails" for product "Rails" and version "3.1.2" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.3 Search vendor "Rubyonrails" for product "Rails" and version "3.1.3" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.4 Search vendor "Rubyonrails" for product "Rails" and version "3.1.4" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.4 Search vendor "Rubyonrails" for product "Rails" and version "3.1.4" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.5 Search vendor "Rubyonrails" for product "Rails" and version "3.1.5" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.5 Search vendor "Rubyonrails" for product "Rails" and version "3.1.5" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.6 Search vendor "Rubyonrails" for product "Rails" and version "3.1.6" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.7 Search vendor "Rubyonrails" for product "Rails" and version "3.1.7" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.8 Search vendor "Rubyonrails" for product "Rails" and version "3.1.8" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.9 Search vendor "Rubyonrails" for product "Rails" and version "3.1.9" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.1.10 Search vendor "Rubyonrails" for product "Rails" and version "3.1.10" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.0 Search vendor "Rubyonrails" for product "Rails" and version "3.2.0" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.0 Search vendor "Rubyonrails" for product "Rails" and version "3.2.0" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.0 Search vendor "Rubyonrails" for product "Rails" and version "3.2.0" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.1 Search vendor "Rubyonrails" for product "Rails" and version "3.2.1" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.2 Search vendor "Rubyonrails" for product "Rails" and version "3.2.2" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.2 Search vendor "Rubyonrails" for product "Rails" and version "3.2.2" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.3 Search vendor "Rubyonrails" for product "Rails" and version "3.2.3" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.3 Search vendor "Rubyonrails" for product "Rails" and version "3.2.3" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.3 Search vendor "Rubyonrails" for product "Rails" and version "3.2.3" | rc2 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.4 Search vendor "Rubyonrails" for product "Rails" and version "3.2.4" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.4 Search vendor "Rubyonrails" for product "Rails" and version "3.2.4" | rc1 |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.5 Search vendor "Rubyonrails" for product "Rails" and version "3.2.5" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.6 Search vendor "Rubyonrails" for product "Rails" and version "3.2.6" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.7 Search vendor "Rubyonrails" for product "Rails" and version "3.2.7" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.8 Search vendor "Rubyonrails" for product "Rails" and version "3.2.8" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.9 Search vendor "Rubyonrails" for product "Rails" and version "3.2.9" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.10 Search vendor "Rubyonrails" for product "Rails" and version "3.2.10" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.11 Search vendor "Rubyonrails" for product "Rails" and version "3.2.11" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | 3.2.12 Search vendor "Rubyonrails" for product "Rails" and version "3.2.12" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Ruby On Rails Search vendor "Rubyonrails" for product "Ruby On Rails" | 3.1.11 Search vendor "Rubyonrails" for product "Ruby On Rails" and version "3.1.11" | - |
Affected
| ||||||