CVE-2013-0155

EUVD-2017-0242

13.01.2013, 22:55

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.4 UNKNOWN	NETWORK	LOW		AV:N/AC:L/Au:N/C:P/I:P/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 95%

Affected Products (NVD)

Vendor	Product	Version
rubyonrails	rails	3.2.0 ≤ 𝑥 < 3.2.11
rubyonrails	ruby_on_rails	3.0.0 ≤ 𝑥 < 3.0.19
rubyonrails	ruby_on_rails	3.1.0 ≤ 𝑥 < 3.1.10
debian	debian_linux	6.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

rails

bookworm	2:6.1.7.3+dfsg-2~deb12u1 fixed
bullseye	2:6.0.3.7+dfsg-2+deb11u2 fixed
bullseye (security)	2:6.0.3.7+dfsg-2+deb11u2 fixed
sid	2:6.1.7.3+dfsg-4 fixed
trixie	2:6.1.7.3+dfsg-4 fixed

Ubuntu Releases

Ubuntu Product

Codename

rails

hardy	ignored
lucid	ignored
oneiric	not-affected
precise	not-affected
quantal	not-affected
raring	not-affected
saucy	not-affected

ruby-actionpack-2.3

hardy	dne
lucid	dne
oneiric	not-affected
precise	not-affected
quantal	not-affected
raring	not-affected
saucy	not-affected

ruby-actionpack-3.2

hardy	dne
lucid	dne
oneiric	dne
precise	dne
quantal	Fixed 3.2.6-4ubuntu0.1 released
raring	not-affected
saucy	not-affected

ruby-activerecord-2.3

hardy	dne
lucid	dne
oneiric	Fixed 2.3.14-1ubuntu0.11.10.1 released
precise	Fixed 2.3.14-1ubuntu0.12.04.1 released
quantal	Fixed 2.3.14-2ubuntu0.1 released
raring	Fixed 2.3.14-4 released
saucy	Fixed 2.3.14-4 released