CVE-2013-6417

2013-12-0700:55:03

Debian Security Bug Tracker

security-tracker.debian.org

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.007 Low

EPSS

Percentile

80.9%

JSON

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

OSVersionArchitecturePackageVersionFilename
Debian12allrails< 2:6.1.7.3+dfsg-2~deb12u1rails_2:6.1.7.3+dfsg-2~deb12u1_all.deb
Debian11allrails< 2:6.0.3.7+dfsg-2+deb11u2rails_2:6.0.3.7+dfsg-2+deb11u2_all.deb
Debian999allrails< 2:6.1.7.3+dfsg-3rails_2:6.1.7.3+dfsg-3_all.deb
Debian13allrails< 2:6.1.7.3+dfsg-3rails_2:6.1.7.3+dfsg-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	rails	< 2:6.1.7.3+dfsg-2~deb12u1	rails_2:6.1.7.3+dfsg-2~deb12u1_all.deb
Debian	11	all	rails	< 2:6.0.3.7+dfsg-2+deb11u2	rails_2:6.0.3.7+dfsg-2+deb11u2_all.deb
Debian	999	all	rails	< 2:6.1.7.3+dfsg-3	rails_2:6.1.7.3+dfsg-3_all.deb
Debian	13	all	rails	< 2:6.1.7.3+dfsg-3	rails_2:6.1.7.3+dfsg-3_all.deb