CVE-2013-0333

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-0333
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0201.html
http://rhn.redhat.com/errata/RHSA-2013-0202.html
http://rhn.redhat.com/errata/RHSA-2013-0203.html
http://support.apple.com/kb/HT5784
http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/
http://www.debian.org/security/2013/dsa-2613
http://www.kb.cert.org/vuls/id/628463 US Government Resource
https://groups.google.com/group/rubyonrails-security/msg/52179af76915e518?dmode=source&output=gplain Vendor Advisory
https://puppet.com/security/cve/cve-2013-0333
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:rubyonrails:rails:2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.3.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.3.11:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.3.12:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.3.13:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.3.14:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:2.3.15:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*
History

13 Feb 2023, 04:41

Type Values Removed Values Added
Summary CVE-2013-0333 rubygem-activesupport: json to yaml parsing lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0203', 'name': 'https://access.redhat.com/errata/RHSA-2013:0203', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/1h2DR63ViGo', 'name': 'https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/1h2DR63ViGo', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=903440', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=903440', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0202', 'name': 'https://access.redhat.com/errata/RHSA-2013:0202', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0201', 'name': 'https://access.redhat.com/errata/RHSA-2013:0201', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2013-0333', 'name': 'https://access.redhat.com/security/cve/CVE-2013-0333', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 18:17

Type Values Removed Values Added
Summary lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156. CVE-2013-0333 rubygem-activesupport: json to yaml parsing
References
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0203 -
  • (MISC) https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/1h2DR63ViGo -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=903440 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0202 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0201 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2013-0333 -
Information

Published : 2013-01-30 12:00

Updated : 2023-12-10 11:16

NVD link : CVE-2013-0333

Mitre link : CVE-2013-0333

CVE.ORG link : CVE-2013-0333

JSON object : View

Products Affected

rubyonrails

  • ruby_on_rails
  • rails
CWE
NVD-CWE-Other