Unscored severity · published Jun 9, 2014
CVE-2013-1756
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request
–
CVSS
3.7%
EPSS
No
On KEV
Description
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DG
Dragonfly Gem · Mark Evans
0.7.0; 0.7.1; 0.7.2; 0.7.3; 0.7.4; 0.7.5; +20 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1756
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1756
secunia.com
http://secunia.com/advisories/52380
www.securityfocus.com
http://www.securityfocus.com/bid/58225
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/82476
Vendor Advisory
https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277
groups.google.com
https://groups.google.com/forum/?fromgroups=#%21topic/dragonfly-users/3c3WIU3VQTo