Lucene search

K

RubySecRUBY:JSON-2013-0269-101137

HistoryFeb 11, 2013 - 8:00 p.m.

CVE-2013-0269 rubygem-json: Denial of Service and SQL Injection

2013-02-1120:00:00

RubySec

nvd.nist.gov

23

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.019

Percentile

88.5%

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7
for Ruby allows remote attackers to cause a denial of service (resource consumption)
or bypass the mass assignment protection mechanism via a crafted JSON document that
triggers the creation of arbitrary Ruby symbols or certain internal objects, as
demonstrated by conducting a SQL injection attack against Ruby on Rails, aka “Unsafe
Object Creation Vulnerability.”

Affected configurations

Vulners

Node

rubyjsonRange1.5.0–1.5.5

OR

rubyjsonRange1.6.0–1.6.8

OR

rubyjsonRange≤1.7.7

VendorProductVersionCPE
rubyjson*cpe:2.3:a:ruby:json:*:*:*:*:*:*:*:*

References

nvd.nist.gov/vuln/detail/CVE-2013-0269

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.019

Percentile

88.5%

Related for RUBY:JSON-2013-0269-101137