5.8

CVE-2013-1856

The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rubyonrails ≫ Rails Version 3.1.0
Rubyonrails ≫ Rails Version 3.1.0 Update beta1
Rubyonrails ≫ Rails Version 3.1.0 Update rc1
Rubyonrails ≫ Rails Version 3.1.0 Update rc2
Rubyonrails ≫ Rails Version 3.1.0 Update rc3
Rubyonrails ≫ Rails Version 3.1.0 Update rc4
Rubyonrails ≫ Rails Version 3.1.0 Update rc5
Rubyonrails ≫ Rails Version 3.1.0 Update rc6
Rubyonrails ≫ Rails Version 3.1.0 Update rc7
Rubyonrails ≫ Rails Version 3.1.0 Update rc8
Rubyonrails ≫ Rails Version 3.1.1
Rubyonrails ≫ Rails Version 3.1.1 Update rc1
Rubyonrails ≫ Rails Version 3.1.1 Update rc2
Rubyonrails ≫ Rails Version 3.1.1 Update rc3
Rubyonrails ≫ Rails Version 3.1.2
Rubyonrails ≫ Rails Version 3.1.2 Update rc1
Rubyonrails ≫ Rails Version 3.1.2 Update rc2
Rubyonrails ≫ Rails Version 3.1.3
Rubyonrails ≫ Rails Version 3.1.4
Rubyonrails ≫ Rails Version 3.1.4 Update rc1
Rubyonrails ≫ Rails Version 3.1.5
Rubyonrails ≫ Rails Version 3.1.5 Update rc1
Rubyonrails ≫ Rails Version 3.1.6
Rubyonrails ≫ Rails Version 3.1.7
Rubyonrails ≫ Rails Version 3.1.8
Rubyonrails ≫ Rails Version 3.1.9
Rubyonrails ≫ Rails Version 3.1.10
Rubyonrails ≫ Rails Version 3.2.0
Rubyonrails ≫ Rails Version 3.2.0 Update rc1
Rubyonrails ≫ Rails Version 3.2.0 Update rc2
Rubyonrails ≫ Rails Version 3.2.1
Rubyonrails ≫ Rails Version 3.2.2
Rubyonrails ≫ Rails Version 3.2.2 Update rc1
Rubyonrails ≫ Rails Version 3.2.3
Rubyonrails ≫ Rails Version 3.2.3 Update rc1
Rubyonrails ≫ Rails Version 3.2.3 Update rc2
Rubyonrails ≫ Rails Version 3.2.4
Rubyonrails ≫ Rails Version 3.2.4 Update rc1
Rubyonrails ≫ Rails Version 3.2.5
Rubyonrails ≫ Rails Version 3.2.6
Rubyonrails ≫ Rails Version 3.2.7
Rubyonrails ≫ Rails Version 3.2.8
Rubyonrails ≫ Rails Version 3.2.9
Rubyonrails ≫ Rails Version 3.2.10
Rubyonrails ≫ Rails Version 3.2.11
Rubyonrails ≫ Rails Version 3.2.12
Rubyonrails ≫ Ruby On Rails Version 3.1.11
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.05% 0.788
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
http://support.apple.com/kb/HT5784
http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
https://groups.google.com/group/rubyonrails-security/msg/6c2482d4ed1545e6?dmode=source&output=gplain