Description

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.

Remediation

References

CVE-2013-1854

Related Vulnerabilities

WordPress Plugin Contact Form 7 Security Bypass (4.1)

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-41866)

WordPress Plugin CBI Referral Manager Cross-Site Scripting (1.2.1)

Sqlite Use After Free Vulnerability (CVE-2020-11656)

Apache Tomcat Other Vulnerability (CVE-2003-0044)

Severity

Medium

Classification

CVE-2013-1854 CWE-20

Tags

Missing Update Known Vulnerabilities