Description

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.

Remediation

References

CVE-2013-1854

Related Vulnerabilities

Apache HTTP Server Improper Input Validation Vulnerability (CVE-2016-2161)

WordPress Plugin Form Maker by 10Web-Mobile-Friendly Drag & Drop Contact Form Builder Cross-Site Request Forgery (1.13.4)

MySQL CVE-2019-2834 Vulnerability (CVE-2019-2834)

Ruby Improper Input Validation Vulnerability (CVE-2015-7551)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-1653)

Severity

Medium

Classification

CVE-2013-1854 CWE-20

Tags

Missing Update Known Vulnerabilities