CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2013-1856

The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.008

EPSS Ranking 72.3%

CVSS Severity

CVSS v2 Score 5.8

References

Products affected by CVE-2013-1856

Rubyonrails » Rails » Version: 3.1.0

cpe:2.3:a:rubyonrails:rails:3.1.0
Rubyonrails » Rails » Version: 3.1.1

cpe:2.3:a:rubyonrails:rails:3.1.1
Rubyonrails » Rails » Version: 3.1.10

cpe:2.3:a:rubyonrails:rails:3.1.10
Rubyonrails » Rails » Version: 3.1.2

cpe:2.3:a:rubyonrails:rails:3.1.2
Rubyonrails » Rails » Version: 3.1.3

cpe:2.3:a:rubyonrails:rails:3.1.3
Rubyonrails » Rails » Version: 3.1.4

cpe:2.3:a:rubyonrails:rails:3.1.4
Rubyonrails » Rails » Version: 3.1.5

cpe:2.3:a:rubyonrails:rails:3.1.5
Rubyonrails » Rails » Version: 3.1.6

cpe:2.3:a:rubyonrails:rails:3.1.6
Rubyonrails » Rails » Version: 3.1.7

cpe:2.3:a:rubyonrails:rails:3.1.7
Rubyonrails » Rails » Version: 3.1.8

cpe:2.3:a:rubyonrails:rails:3.1.8
Rubyonrails » Rails » Version: 3.1.9

cpe:2.3:a:rubyonrails:rails:3.1.9
Rubyonrails » Rails » Version: 3.2.0

cpe:2.3:a:rubyonrails:rails:3.2.0
Rubyonrails » Rails » Version: 3.2.1

cpe:2.3:a:rubyonrails:rails:3.2.1
Rubyonrails » Rails » Version: 3.2.10

cpe:2.3:a:rubyonrails:rails:3.2.10
Rubyonrails » Rails » Version: 3.2.11

cpe:2.3:a:rubyonrails:rails:3.2.11
Rubyonrails » Rails » Version: 3.2.12

cpe:2.3:a:rubyonrails:rails:3.2.12
Rubyonrails » Rails » Version: 3.2.2

cpe:2.3:a:rubyonrails:rails:3.2.2
Rubyonrails » Rails » Version: 3.2.3

cpe:2.3:a:rubyonrails:rails:3.2.3
Rubyonrails » Rails » Version: 3.2.4

cpe:2.3:a:rubyonrails:rails:3.2.4
Rubyonrails » Rails » Version: 3.2.5

cpe:2.3:a:rubyonrails:rails:3.2.5
Rubyonrails » Rails » Version: 3.2.6

cpe:2.3:a:rubyonrails:rails:3.2.6
Rubyonrails » Rails » Version: 3.2.7

cpe:2.3:a:rubyonrails:rails:3.2.7
Rubyonrails » Rails » Version: 3.2.8

cpe:2.3:a:rubyonrails:rails:3.2.8
Rubyonrails » Rails » Version: 3.2.9

cpe:2.3:a:rubyonrails:rails:3.2.9
Rubyonrails » Ruby On Rails » Version: 3.1.11

cpe:2.3:a:rubyonrails:ruby_on_rails:3.1.11

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2013-1856

Products

Pricing

Contact Us