CVE-2013-1856
- State
- Published
- Severity
- Not scored
- Published
- Mar 19, 2013
- Updated
- Aug 6, 2024
- Reserved
- Feb 19, 2013
Description
The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- APPLE-SA-2013-10-22-5vendor-advisory
- http://support.apple.com/kb/HT5784
- APPLE-SA-2013-06-04-1vendor-advisory
- [rubyonrails-security] 20130318 [CVE-2013-1856] XML Parsing Vulnerability affecting JRuby usersmailing-list
- http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.