Lucene search
HistoryDec 07, 2013 - 12:55 a.m.
CVE-2013-6417
cve
2013
6417
ruby on rails
parameter handling
remote attackers
third-party rack middleware
custom rack middleware
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
7.5 High
AI Score
Confidence
High
0.007 Low
EPSS
Percentile
80.9%
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
Affected configurations
Node
rubyonrailsrailsMatch3.0.0
ORrubyonrailsrailsMatch3.0.0beta
ORrubyonrailsrailsMatch3.0.0beta2
ORrubyonrailsrailsMatch3.0.0beta3
ORrubyonrailsrailsMatch3.0.0beta4
ORrubyonrailsrailsMatch3.0.0rc
ORrubyonrailsrailsMatch3.0.0rc2
ORrubyonrailsrailsMatch3.0.1
ORrubyonrailsrailsMatch3.0.1pre
ORrubyonrailsrailsMatch3.0.2
ORrubyonrailsrailsMatch3.0.2pre
ORrubyonrailsrailsMatch3.0.3
ORrubyonrailsrailsMatch3.0.4rc1
ORrubyonrailsrailsMatch3.0.5
ORrubyonrailsrailsMatch3.0.5rc1
ORrubyonrailsrailsMatch3.0.6
ORrubyonrailsrailsMatch3.0.6rc1
ORrubyonrailsrailsMatch3.0.6rc2
ORrubyonrailsrailsMatch3.0.7
ORrubyonrailsrailsMatch3.0.7rc1
ORrubyonrailsrailsMatch3.0.7rc2
ORrubyonrailsrailsMatch3.0.8
ORrubyonrailsrailsMatch3.0.8rc1
ORrubyonrailsrailsMatch3.0.8rc2
ORrubyonrailsrailsMatch3.0.8rc3
ORrubyonrailsrailsMatch3.0.8rc4
ORrubyonrailsrailsMatch3.0.9
ORrubyonrailsrailsMatch3.0.9rc1
ORrubyonrailsrailsMatch3.0.9rc2
ORrubyonrailsrailsMatch3.0.9rc3
ORrubyonrailsrailsMatch3.0.9rc4
ORrubyonrailsrailsMatch3.0.9rc5
ORrubyonrailsrailsMatch3.0.10
ORrubyonrailsrailsMatch3.0.10rc1
ORrubyonrailsrailsMatch3.0.11
ORrubyonrailsrailsMatch3.0.12
ORrubyonrailsrailsMatch3.0.12rc1
ORrubyonrailsrailsMatch3.0.13
ORrubyonrailsrailsMatch3.0.13rc1
ORrubyonrailsrailsMatch3.0.14
ORrubyonrailsrailsMatch3.0.16
ORrubyonrailsrailsMatch3.0.17
ORrubyonrailsrailsMatch3.0.18
ORrubyonrailsrailsMatch3.0.19
ORrubyonrailsrailsMatch3.0.20
ORrubyonrailsrailsMatch3.1.0
ORrubyonrailsrailsMatch3.1.0beta1
ORrubyonrailsrailsMatch3.1.0rc1
ORrubyonrailsrailsMatch3.1.0rc2
ORrubyonrailsrailsMatch3.1.0rc3
ORrubyonrailsrailsMatch3.1.0rc4
ORrubyonrailsrailsMatch3.1.0rc5
ORrubyonrailsrailsMatch3.1.0rc6
ORrubyonrailsrailsMatch3.1.0rc7
ORrubyonrailsrailsMatch3.1.0rc8
ORrubyonrailsrailsMatch3.1.1
ORrubyonrailsrailsMatch3.1.1rc1
ORrubyonrailsrailsMatch3.1.1rc2
ORrubyonrailsrailsMatch3.1.1rc3
ORrubyonrailsrailsMatch3.1.2
ORrubyonrailsrailsMatch3.1.2rc1
ORrubyonrailsrailsMatch3.1.2rc2
ORrubyonrailsrailsMatch3.1.3
ORrubyonrailsrailsMatch3.1.4
ORrubyonrailsrailsMatch3.1.4rc1
ORrubyonrailsrailsMatch3.1.5
ORrubyonrailsrailsMatch3.1.5rc1
ORrubyonrailsrailsMatch3.1.6
ORrubyonrailsrailsMatch3.1.7
ORrubyonrailsrailsMatch3.1.8
ORrubyonrailsrailsMatch3.1.9
ORrubyonrailsrailsMatch3.1.10
ORrubyonrailsrailsMatch3.2.0
ORrubyonrailsrailsMatch3.2.0rc1
ORrubyonrailsrailsMatch3.2.0rc2
ORrubyonrailsrailsMatch3.2.1
ORrubyonrailsrailsMatch3.2.2
ORrubyonrailsrailsMatch3.2.2rc1
ORrubyonrailsrailsMatch3.2.3
ORrubyonrailsrailsMatch3.2.3rc1
ORrubyonrailsrailsMatch3.2.3rc2
ORrubyonrailsrailsMatch3.2.4
ORrubyonrailsrailsMatch3.2.4rc1
ORrubyonrailsrailsMatch3.2.5
ORrubyonrailsrailsMatch3.2.6
ORrubyonrailsrailsMatch3.2.7
ORrubyonrailsrailsMatch3.2.8
ORrubyonrailsrailsMatch3.2.9
ORrubyonrailsrailsMatch3.2.10
ORrubyonrailsrailsMatch3.2.11
ORrubyonrailsrailsMatch3.2.12
ORrubyonrailsrailsMatch3.2.13
ORrubyonrailsrailsMatch3.2.13rc1
ORrubyonrailsrailsMatch3.2.13rc2
ORrubyonrailsruby_on_railsRange≤3.2.15
ORrubyonrailsruby_on_railsMatch3.0.4
ORrubyonrailsruby_on_railsMatch3.1.11
ORrubyonrailsruby_on_railsMatch3.2.14
ORrubyonrailsruby_on_railsMatch3.2.14rc1
ORrubyonrailsruby_on_railsMatch3.2.14rc2
ORrubyonrailsruby_on_railsMatch3.2.15rc1
ORrubyonrailsruby_on_railsMatch3.2.15rc2
Node
rubyonrailsrailsRange≤4.0.1-
ORrubyonrailsrailsMatch4.0.0-
ORrubyonrailsrailsMatch4.0.0beta
ORrubyonrailsrailsMatch4.0.0rc1
ORrubyonrailsrailsMatch4.0.0rc2
ORrubyonrailsrailsMatch4.0.1rc1
References
lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
rhn.redhat.com/errata/RHSA-2013-1794.html
rhn.redhat.com/errata/RHSA-2014-0008.html
rhn.redhat.com/errata/RHSA-2014-0469.html
weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
www.debian.org/security/2014/dsa-2888
groups.google.com/forum/message/raw?msg=ruby-security-ann/niK4drpSHT4/g8JW8ZsayRkJ
puppet.com/security/cve/cve-2013-6417
Related
osv
osv
actionpack allows bypass of database-query restrictions
2017-10-24 18:33:36
Active Record allows bypassing of database-query restrictions
2017-10-24 18:33:37
ActiveRecord in Ruby on Rails allows database-query bypass
2017-10-24 18:33:35
github
github
actionpack allows bypass of database-query restrictions
2017-10-24 18:33:36
Moderate severity vulnerability that affects activerecord
2018-08-13 20:49:01
Active Record allows bypassing of database-query restrictions
2017-10-24 18:33:37
veracode
veracode
Database Authorization Bypass
2019-01-15 09:01:52
prion
prion
Design/Logic Flaw
2013-12-07 00:55:00
Design/Logic Flaw
2013-01-13 22:55:00
Design/Logic Flaw
2016-09-07 19:28:00
cvelist
cvelist
debiancve
debiancve
ubuntucve
ubuntucve
gitlab
gitlab
Incomplete fix to CVE-2013-0155 (Unsafe Query Generation Risk)
2013-12-06 00:00:00
Unsafe Query Generation Risk in Ruby on Rails
2013-01-13 00:00:00
Unsafe Query Generation Risk
2016-09-07 00:00:00
nvd
nvd
redhat
redhat
(RHSA-2014:0008) Important: ruby193-rubygem-actionpack security update
2014-01-06 00:00:00
(RHSA-2013:1794) Important: ruby193-rubygem-actionpack security update
2013-12-05 00:00:00
(RHSA-2014:0469) Important: cfme security, bug fix, and enhancement update
2014-05-12 00:00:00
nessus
nessus
openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2013:1904-1)
2014-06-13 00:00:00
openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2013:1906-1)
2014-06-13 00:00:00
openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2013:1907-1)
2014-06-13 00:00:00
openvas
openvas
Fedora Update for rubygem-actionpack FEDORA-2013-23636
2014-03-12 00:00:00
Fedora Update for rubygem-actionpack FEDORA-2013-23636
2014-03-12 00:00:00
Fedora Update for rubygem-actionpack FEDORA-2014-3232
2014-03-12 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: rubygem-actionpack-4.0.0-2.fc20
2014-03-07 06:36:05
[SECURITY] Fedora 19 Update: rubygem-actionpack-3.2.13-5.fc19
2014-03-11 04:11:08
[SECURITY] Fedora 19 Update: rubygem-actionpack-3.2.13-4.fc19
2014-01-24 07:50:26
freebsd
freebsd
rails -- multiple vulnerabilities
2013-12-03 00:00:00
rubygem-rails -- multiple vulnerabilities
2013-01-08 00:00:00
Rails 4 -- Unsafe Query Generation Risk in Active Record
2016-08-11 00:00:00
securityvulns
securityvulns
[SECURITY] [DSA 2888-1] ruby-actionpack-3.2 security update
2014-05-04 00:00:00
Ruby Actionpack / Actionmailer multiple security vulnerabilities
2014-05-04 00:00:00
Apple Mac OS X multiple security vulnerabilities
2013-06-17 00:00:00
debian
debian
[SECURITY] [DSA 2888-1] ruby-actionpack-3.2 security update
2014-03-27 15:04:16
[SECURITY] [DSA 2609-1] rails security update
2013-01-16 21:17:01
seebug
seebug
Ruby on Rails不安全查询生成漏洞
2013-01-10 00:00:00
rubygems
rubygems
Incomplete fix to CVE-2013-0155 (Unsafe Query Generation Risk)
2013-12-02 20:00:00
CVE-2013-0155 rubygem-actionpack, rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails
2013-01-07 20:00:00
Unsafe Query Generation Risk in Active Record
2016-08-10 21:00:00
ics
ics
cve
cve
CVE-2013-0155
2013-01-13 22:55:00
CVE-2016-6317
2016-09-07 19:28:11
hackerone
hackerone
suse
suse
ruby on rails to 2.3.16 (important)
2013-02-12 11:04:29
ruby on rails to 2.3.16 (important)
2013-02-12 10:10:39
Security update for Ruby On Rails (important)
2013-03-19 18:04:46
ibm
ibm
gentoo
gentoo
Ruby on Rails: Multiple vulnerabilities
2014-12-14 00:00:00
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
7.5 High
AI Score
Confidence
High
0.007 Low
EPSS
Percentile
80.9%
Related for CVE-2013-6417