CVE-2013-0175: Input Validation
multixml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0175?
The severity of CVE-2013-0175 is considered high due to the potential for remote code execution and denial of service.
How do I fix CVE-2013-0175?
To fix CVE-2013-0175, upgrade the multi_xml gem to version 0.5.3 or later.
What software is affected by CVE-2013-0175?
CVE-2013-0175 affects the multi_xml gem versions up to and including 0.5.2, particularly when used with Grape versions earlier than 0.2.6.
What kind of attacks can CVE-2013-0175 enable?
CVE-2013-0175 can enable remote attackers to conduct object-injection attacks, allowing them to execute arbitrary code or cause system resource exhaustion.
Is my application safe if it uses a version of Grape after 0.2.6?
Yes, applications using Grape version 0.2.6 or later are not vulnerable to CVE-2013-0175.