CVE-2013-6414
NoneCVSS
—
EPSS
20.7%
Published
Dec 7, 2013
CISA due date
—
The record
actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| RubyGems | actionpack | 3.0.0 | 3.2.16 |
| RubyGems | actionpack | 4.0.0 | 4.0.2 |
| Debian:7 | ruby-actionpack-3.2 | 0 | 3.2.6-6+deb7u1 |
| Red Hat:openstack:3::el6 | ruby193-rubygem-actionpack | 0 | 1:3.2.8-5.1.el6 |
| Red Hat:openstack:3::el6 | ruby193-rubygem-actionpack-doc | 0 | 1:3.2.8-5.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-rubygem-actionpack | 0 | 1:3.2.8-5.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-rubygem-actionpack-doc | 0 | 1:3.2.8-5.1.el6 |
| Ubuntu:14.04:LTS | ruby-actionpack-3.2 | 0 | 3.2.16-3 |
| gem | actionpack | 4.0 | 4.0.2 |
| gem | rails | 3.0.0 | 3.2.16 |
| gem | rails | 4.0.0.beta1 | 4.0.2 |
Related vulnerabilities
- CVE-2023-28362 The redirect_to method in Rails allows provided values to contain characters which are… Also affects actionpack
- CVE-2024-54133 Action Pack is a framework for handling and responding to web requests. Also affects actionpack
- CVE-2024-47887 Action Pack is a framework for handling and responding to web requests. Also affects actionpack
- CVE-2024-41128 Action Pack is a framework for handling and responding to web requests. Also affects actionpack
- CVE-2022-22577 An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to… Also affects actionpack
- CVE-2020-8166 A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it… Also affects actionpack
- CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before… Also affects actionpack
- CVE-2016-0752 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… Also affects actionpack