Description

The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.

Remediation

References

CVE-2015-3227

Related Vulnerabilities

ReviveAdserver Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-22875)

WebLogic CVE-2019-2452 Vulnerability (CVE-2019-2452)

LimeSurvey Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2019-25019)

Oracle Database Server CVE-2013-3826 Vulnerability (CVE-2013-3826)

WordPress Plugin Share, Print and PDF Products for WooCommerce Security Bypass (2.7.2)

Severity

Medium

Classification

CVE-2015-3227

Tags

Missing Update Known Vulnerabilities