CVE-2013-0333: lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML…

Unscored severity · published Jan 30, 2013

CVE-2013-0333

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML…

–

CVSS

95.6%

EPSS

On KEV

Description

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.

Exploitation

Is it being used?

Exploit prediction (EPSS)95.6% · higher than 100% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Rails · Rubyonrails

2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.9; +34 more · source: NVD

Ruby ON Rails · Rubyonrails

3.0.4 · source: NVD