CVE-2013-0333
NoneCVSS
—
EPSS
95.6%
Published
Jan 30, 2013
CISA due date
—
The record
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| RubyGems | activesupport | 2.3.2 | 2.3.16 |
| RubyGems | activesupport | 3.0.0 | 3.0.20 |
| Debian:11 | rails | 0 | 2.3.14.1 |
| Debian:12 | rails | 0 | 2.3.14.1 |
| Debian:13 | rails | 0 | 2.3.14.1 |
| Debian:6.0 | rails | 0 | 2.3.5-1.2+squeeze6 |
| Red Hat:openshift:1::el6 | rubygem-activesupport | 0 | 1:3.0.13-4.el6op |
| gem | activesupport | 2.4.0 | 3.0.20 |
Related vulnerabilities
- CVE-2023-28120 There is a vulnerability in ActiveSupport if the new bytesplice method is called on a… Also affects activesupport
- CVE-2023-38037 ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. Also affects activesupport
- CVE-2023-22796 A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. Also affects activesupport
- CVE-2025-55193 Active Record connects classes to relational database tables. Also affects rails
- CVE-2023-23913 There is a potential DOM based cross-site scripting issue in rails-ujs which leverages… Also affects rails
- CVE-2023-28362 The redirect_to method in Rails allows provided values to contain characters which are… Also affects rails
- CVE-2024-54133 Action Pack is a framework for handling and responding to web requests. Also affects rails
- CVE-2024-47889 Action Mailer is a framework for designing email service layers. Also affects rails