Lucene search
RedhatCVE-2013-0276HistoryFeb 13, 2013 - 1:55 a.m.
CVE-2013-0276
2013-02-1301:55:05
CWE-264
redhat
web.nvd.nist.gov
81
cve-2013-0276
ruby on rails
activerecord
security vulnerability
attr_protected
remote attack
nvd
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
6.2
Confidence
Low
EPSS
0.009
Percentile
83.0%
ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.
Affected configurations
Node
rubyonrailsrailsMatch3.2.0
ORrubyonrailsrailsMatch3.2.0rc1
ORrubyonrailsrailsMatch3.2.0rc2
ORrubyonrailsrailsMatch3.2.1
ORrubyonrailsrailsMatch3.2.2
ORrubyonrailsrailsMatch3.2.2rc1
ORrubyonrailsrailsMatch3.2.3
ORrubyonrailsrailsMatch3.2.3rc1
ORrubyonrailsrailsMatch3.2.3rc2
ORrubyonrailsrailsMatch3.2.4
ORrubyonrailsrailsMatch3.2.4rc1
ORrubyonrailsrailsMatch3.2.5
ORrubyonrailsrailsMatch3.2.6
ORrubyonrailsrailsMatch3.2.7
ORrubyonrailsrailsMatch3.2.8
ORrubyonrailsrailsMatch3.2.9
ORrubyonrailsrailsMatch3.2.10
ORrubyonrailsrailsMatch3.2.11
Node
rubyonrailsrailsMatch3.1.0
ORrubyonrailsrailsMatch3.1.0beta1
ORrubyonrailsrailsMatch3.1.0rc1
ORrubyonrailsrailsMatch3.1.0rc2
ORrubyonrailsrailsMatch3.1.0rc3
ORrubyonrailsrailsMatch3.1.0rc4
ORrubyonrailsrailsMatch3.1.0rc5
ORrubyonrailsrailsMatch3.1.0rc6
ORrubyonrailsrailsMatch3.1.0rc7
ORrubyonrailsrailsMatch3.1.0rc8
ORrubyonrailsrailsMatch3.1.1
ORrubyonrailsrailsMatch3.1.1rc1
ORrubyonrailsrailsMatch3.1.1rc2
ORrubyonrailsrailsMatch3.1.1rc3
ORrubyonrailsrailsMatch3.1.2
ORrubyonrailsrailsMatch3.1.2rc1
ORrubyonrailsrailsMatch3.1.2rc2
ORrubyonrailsrailsMatch3.1.3
ORrubyonrailsrailsMatch3.1.4
ORrubyonrailsrailsMatch3.1.4rc1
ORrubyonrailsrailsMatch3.1.5
ORrubyonrailsrailsMatch3.1.5rc1
ORrubyonrailsrailsMatch3.1.6
ORrubyonrailsrailsMatch3.1.7
ORrubyonrailsrailsMatch3.1.8
ORrubyonrailsrailsMatch3.1.9
ORrubyonrailsrailsMatch3.1.10
Node
rubyonrailsrailsMatch2.3.0
ORrubyonrailsrailsMatch2.3.1
ORrubyonrailsrailsMatch2.3.2
ORrubyonrailsrailsMatch2.3.3
ORrubyonrailsrailsMatch2.3.4
ORrubyonrailsrailsMatch2.3.9
ORrubyonrailsrailsMatch2.3.10
ORrubyonrailsrailsMatch2.3.11
ORrubyonrailsrailsMatch2.3.12
ORrubyonrailsrailsMatch2.3.13
ORrubyonrailsrailsMatch2.3.14
ORrubyonrailsrailsMatch2.3.15
ORrubyonrailsrailsMatch2.3.16
| Vendor | Product | Version | CPE |
|---|---|---|---|
| rubyonrails | rails | 3.2.0 | cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.2.0 | cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.2.0 | cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:* |
| rubyonrails | rails | 3.2.1 | cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.2.2 | cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.2.2 | cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.2.3 | cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.2.3 | cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.2.3 | cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:* |
| rubyonrails | rails | 3.2.4 | cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:* |
References
lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
rhn.redhat.com/errata/RHSA-2013-0686.html
secunia.com/advisories/52112
secunia.com/advisories/52774
support.apple.com/kb/HT5784
weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/
www.debian.org/security/2013/dsa-2620
www.openwall.com/lists/oss-security/2013/02/11/5
www.osvdb.org/90072
www.securityfocus.com/bid/57896
groups.google.com/group/rubyonrails-security/msg/bb44b98a73ef1a06?dmode=source&output=gplain
Related
seebug
seebug
Ruby on Rails 远程安全绕过漏洞(CVE-2013-0276)
2013-03-07 00:00:00
fedora
fedora
[SECURITY] Fedora 18 Update: rubygem-activemodel-3.2.8-2.fc18
2013-02-21 05:37:58
[SECURITY] Fedora 17 Update: rubygem-activemodel-3.0.11-3.fc17
2013-02-21 05:38:11
gitlab
gitlab
Circumvention of attr_protected
2013-02-12 00:00:00
Circumvention of attr_protected
2013-02-12 00:00:00
osv
osv
ActiveRecord vulnerable to modification of protected model attributes
2017-10-24 18:33:37
rails - several
2013-02-12 00:00:00
nvd
nvd
CVE-2013-0276
2013-02-13 01:55:05
github
github
ActiveRecord vulnerable to modification of protected model attributes
2017-10-24 18:33:37
openvas
openvas
Fedora Update for rubygem-activemodel FEDORA-2013-2398
2013-02-22 00:00:00
Fedora Update for rubygem-activemodel FEDORA-2013-2398
2013-02-22 00:00:00
Debian Security Advisory DSA 2620-1 (rails - several vulnerabilities)
2013-02-12 00:00:00
nessus
nessus
Fedora 17 : rubygem-activemodel-3.0.11-3.fc17 (2013-2391)
2013-02-21 00:00:00
FreeBSD : Ruby Activemodel Gem -- Circumvention of attr_protected (beab40bf-c1ca-4d2b-ad46-2f14bac8a968)
2013-02-18 00:00:00
Fedora 18 : rubygem-activemodel-3.2.8-2.fc18 (2013-2398)
2013-02-21 00:00:00
cvelist
cvelist
CVE-2013-0276
2013-02-13 01:00:00
debiancve
debiancve
CVE-2013-0276
2013-02-13 01:55:05
freebsd
freebsd
Ruby Activemodel Gem -- Circumvention of attr_protected
2013-02-11 00:00:00
prion
prion
Cross site request forgery (csrf)
2013-02-13 01:55:00
ubuntucve
ubuntucve
CVE-2013-0276
2013-02-13 00:00:00
rubygems
rubygems
securityvulns
securityvulns
[SECURITY] [DSA 2620-1] rails security update
2013-02-18 00:00:00
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
2013-02-18 00:00:00
Apple Mac OS X multiple security vulnerabilities
2013-06-17 00:00:00
debian
debian
[SECURITY] [DSA 2620-1] rails security update
2013-02-12 21:09:50
threatpost
threatpost
Ruby on Rails Patches DoS, Remote Execution Flaws
2013-02-13 17:51:57
suse
suse
Security update for Ruby On Rails (important)
2013-03-19 18:04:46
Security update for Ruby on Rails (important)
2013-04-03 20:06:19
veracode
veracode
Input Validation Bypass
2019-05-02 04:44:16
Arbitrary Code Execution
2019-05-02 04:44:25
redhat
redhat
(RHSA-2013:0686) Moderate: Subscription Asset Manager 1.2.1 update
2013-03-26 00:00:00
(RHSA-2013:0582) Moderate: Red Hat OpenShift Enterprise 1.1.1 update
2013-02-28 00:00:00
gentoo
gentoo
Ruby on Rails: Multiple vulnerabilities
2014-12-14 00:00:00
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
6.2
Confidence
Low
EPSS
0.009
Percentile
83.0%
Related for CVE-2013-0276