CVE-2013-0155: debian debian_linux
Vulnerability summary
CVE-2013-0155 is a medium (CVSS 6.4) vulnerability in debian debian_linux. EPSS estimates a 8.24% chance of exploitation in the next 30 days, higher than 94.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 13-01-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
8.24%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 8.24% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- rails< 2.3.14.1 | < 2.3.5-1.2+squeeze5
- debian_linuxEOL6.0
Rubyonrails2 products
- rails≥ 3.2.0, < 3.2.11
- ruby_on_rails≥ 3.0.0, < 3.0.19 | ≥ 3.1.0, < 3.1.10
RubyGems1 product
- activerecord≥ 3.0.0, < 3.0.19 | ≥ 3.1.0, < 3.1.10 | ≥ 3.2.0, < 3.2.11
3 vendors · 5 products
References
15 links- lists.opensuse.org/opensuse-updates/2013-12/msg00081.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2014-01/msg00003.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2013-12/msg00082.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party AdvisoryWEB
- lists.apple.com/archives/security-announce/2013/Jun/msg00000.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2013-12/msg00079.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party AdvisoryWEB
- ics-cert.us-cert.gov/advisories/ICSA-13-036-01AX Refsource MISCThird Party AdvisoryUS Government ResourceWEB
Show all 15 references
- groups.google.com/group/rubyonrails-security/msg/bc6f13dafe130ee9?dmode=source&output=gplainMailing ListX Refsource MLISTThird Party AdvisoryWEB
