7.5
CVE-2013-0175
- EPSS 1.27%
- Veröffentlicht 25.04.2013 23:55:01
- Zuletzt bearbeitet 11.04.2025 00:51:21
- Quelle secalert@redhat.com
- CVE-Watchlists
- Unerledigt
Loginmulti_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Erik Michaels-ober ≫ Multi Xml Version0.5.2
Erik Michaels-ober ≫ Multi Xml Version0.5.2
Grape Project ≫ Grape Version0.1.0
Grape Project ≫ Grape Version0.1.1
Grape Project ≫ Grape Version0.1.2
Grape Project ≫ Grape Version0.1.3
Grape Project ≫ Grape Version0.1.4
Grape Project ≫ Grape Version0.1.5
Grape Project ≫ Grape Version0.2.0
Grape Project ≫ Grape Version0.2.1
Grape Project ≫ Grape Version0.2.2
Grape Project ≫ Grape Version0.2.3
Grape Project ≫ Grape Version0.2.4
Grape Project ≫ Grape Version0.2.5
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.27% | 0.791 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.