Vulnerability in Rubyonrails Rails
CVE-2013-0277
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 10.0 (High). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.075 (94.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 94.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.075 · newest: 0.075 · change: 0.000
Affected products
- Rubyonrails Rails — versions 3.0.0, 3.0.1, 3.0.2
- Rubyonrails Ruby On Rails — versions 3.0.4
References
- securitytracker.com/id (vdb-entry)
- puppet.com/security/cve/cve-2013-0277
- support.apple.com/kb/HT5784
- www.debian.org/security/2013/dsa-2620 (vendor-advisory)
- lists.apple.com/archives/security-announce/2013/Jun/msg00000.html (vendor-advisory)
- www.osvdb.org/90073 (vdb-entry)
- groups.google.com/group/rubyonrails-security/msg/302ec7ce90f13837 (mailing-list)
- lists.opensuse.org/opensuse-updates/2013-03/msg00048.html (vendor-advisory)
- www.openwall.com/lists/oss-security/2013/02/11/6 (mailing-list, Patch)
- weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-be…