PT-2013-2202 · Ruby+1 · Ruby On Rails+3
Ben Murphy
+1
·
Publicado
2013-02-12
·
Atualizado
2022-04-18
·
CVE-2013-0269
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
JSON gem versions prior to 1.5.5
JSON gem versions 1.6.x prior to 1.6.8
JSON gem versions 1.7.x prior to 1.7.7
Description
The issue allows remote attackers to cause a denial of service or bypass the mass assignment protection mechanism via a crafted JSON document. This can trigger the creation of arbitrary Ruby symbols or certain internal objects, potentially leading to attacks such as SQL injection against Ruby on Rails.
Recommendations
For JSON gem versions prior to 1.5.5, update to version 1.5.5 or later.
For JSON gem versions 1.6.x prior to 1.6.8, update to version 1.6.8 or later.
For JSON gem versions 1.7.x prior to 1.7.7, update to version 1.7.7 or later.
Exploit
Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Json Gem
Ruby
Ruby On Rails
Suse