CVE-2013-0175
Published Apr 25, 2013
Last updated 2 years ago
Overview
- Description
- multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Source
- secalert@redhat.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 6.4
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-20
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erik_michaels-ober:multi_xml:0.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28BB74BA-387E-4EDC-89BD-C83A5F7E8757"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "264DD094-A8CD-465D-B279-C834DDA5F79C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erik_michaels-ober:multi_xml:0.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28BB74BA-387E-4EDC-89BD-C83A5F7E8757"
},
{
"criteria": "cpe:2.3:a:grape_project:grape:0.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1E127DAB-366C-4EF8-BA31-75710F6C3EB8"
},
{
"criteria": "cpe:2.3:a:grape_project:grape:0.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2232040-600B-4700-A003-4938A69472AF"
},
{
"criteria": "cpe:2.3:a:grape_project:grape:0.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D32EC21-9ED8-4AB9-A863-377B3FC65524"
},
{
"criteria": "cpe:2.3:a:grape_project:grape:0.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "911EEC0A-A036-4612-ADA0-F37A60391731"
},
{
"criteria": "cpe:2.3:a:grape_project:grape:0.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AE5ED3F1-5108-41CE-9136-76C637D1515E"
},
{
"criteria": "cpe:2.3:a:grape_project:grape:0.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A782D309-3921-41A9-B651-7140DAA3B8F8"
},
{
"criteria": "cpe:2.3:a:grape_project:grape:0.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B936CD4A-AC45-44B0-A583-7F2EC00AEC0A"
},
{
"criteria": "cpe:2.3:a:grape_project:grape:0.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A3F9EBC0-F68A-403D-9EE8-E3B028B6AD08"
},
{
"criteria": "cpe:2.3:a:grape_project:grape:0.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB8D75D8-3E36-4416-B340-BF106E851AA9"
},
{
"criteria": "cpe:2.3:a:grape_project:grape:0.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13955945-3FBD-4A5E-8412-B0FAE846ABAC"
},
{
"criteria": "cpe:2.3:a:grape_project:grape:0.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "332884DB-6D64-42F2-B377-1AEB7FF62DF2"
},
{
"criteria": "cpe:2.3:a:grape_project:grape:0.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8BE3F96-6394-45ED-A606-516A76A213F6"
}
],
"operator": "OR"
}
]
}
]