CVE-2013-0155

2013-01-1322:55:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2013-0155

ruby

rails

security

vulnerability

cve

parameter handling

active record

json

database-query restrictions

null checks

where clauses

remote attack

nvd

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

7.5 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.8%

JSON

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain “[nil]” values, a related issue to CVE-2012-2660 and CVE-2012-2694.

Affected configurations

NVD

Node

rubyonrailsrailsRange3.2.0–3.2.11

rubyonrailsruby_on_railsRange3.0.0–3.0.19

rubyonrailsruby_on_railsRange3.1.0–3.1.10

Node

debiandebian_linuxMatch6.0

CPENameOperatorVersion
rubyonrails:railsrubyonrails railslt3.2.11
rubyonrails:ruby_on_railsrubyonrails ruby on railslt3.0.19
rubyonrails:ruby_on_railsrubyonrails ruby on railslt3.1.10

CPE	Name	Operator	Version
rubyonrails:rails	rubyonrails rails	lt	3.2.11
rubyonrails:ruby_on_rails	rubyonrails ruby on rails	lt	3.0.19
rubyonrails:ruby_on_rails	rubyonrails ruby on rails	lt	3.1.10