CVE-2013-0276: Medium severity ruby on rails vulnerability

Q: What is the severity of CVE-2013-0276?

CVE-2013-0276 has a medium severity rating due to its potential to allow unauthorized modification of protected attributes in Ruby on Rails applications.

Q: How do I fix CVE-2013-0276?

To fix CVE-2013-0276, ensure that you upgrade to the patched versions of Ruby on Rails: 2.3.17, 3.1.11, or 3.2.12 and later.

Q: What versions of Ruby on Rails are affected by CVE-2013-0276?

CVE-2013-0276 affects Ruby on Rails versions prior to 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12.

Q: Can CVE-2013-0276 be exploited remotely?

Yes, CVE-2013-0276 can be exploited by remote attackers through crafted requests to bypass the `attr_protected` mechanisms.

Q: Is CVE-2013-0276 a common vulnerability?

CVE-2013-0276 is considered significant due to the widespread use of Ruby on Rails, making it a common target for attackers.

Published Feb 13, 2013

Updated

ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attrprotected protection mechanism and modify protected model attributes via a crafted request.

Other sources

Affected Software

61 affected componentsFixes available

rubygems/activerecord>=3.2.0<3.2.12

3.2.12

rubygems/activerecord>=3.1.0<3.1.11

3.1.11

rubygems/activerecord<2.3.17

2.3.17

rubyonrails Rails=3.2.0

rubyonrails Rails=3.2.0-rc1

rubyonrails Rails=3.2.0-rc2

rubyonrails Rails=3.2.1

rubyonrails Rails=3.2.2

rubyonrails Rails=3.2.2-rc1

rubyonrails Rails=3.2.3

rubyonrails Rails=3.2.3-rc1

rubyonrails Rails=3.2.3-rc2

rubyonrails Rails=3.2.4

rubyonrails Rails=3.2.4-rc1

rubyonrails Rails=3.2.5

rubyonrails Rails=3.2.6

rubyonrails Rails=3.2.7

rubyonrails Rails=3.2.8

rubyonrails Rails=3.2.9

rubyonrails Rails=3.2.10

rubyonrails Rails=3.2.11

rubyonrails Rails=3.1.0

rubyonrails Rails=3.1.0-beta1

rubyonrails Rails=3.1.0-rc1

rubyonrails Rails=3.1.0-rc2

rubyonrails Rails=3.1.0-rc3

rubyonrails Rails=3.1.0-rc4

rubyonrails Rails=3.1.0-rc5

rubyonrails Rails=3.1.0-rc6

rubyonrails Rails=3.1.0-rc7

rubyonrails Rails=3.1.0-rc8

rubyonrails Rails=3.1.1

rubyonrails Rails=3.1.1-rc1

rubyonrails Rails=3.1.1-rc2

rubyonrails Rails=3.1.1-rc3

rubyonrails Rails=3.1.2

rubyonrails Rails=3.1.2-rc1

rubyonrails Rails=3.1.2-rc2

rubyonrails Rails=3.1.3

rubyonrails Rails=3.1.4

rubyonrails Rails=3.1.4-rc1

rubyonrails Rails=3.1.5

rubyonrails Rails=3.1.5-rc1

rubyonrails Rails=3.1.6

rubyonrails Rails=3.1.7

rubyonrails Rails=3.1.8

rubyonrails Rails=3.1.9

rubyonrails Rails=3.1.10

rubyonrails Rails=2.3.0

rubyonrails Rails=2.3.1

rubyonrails Rails=2.3.2

rubyonrails Rails=2.3.3

rubyonrails Rails=2.3.4

rubyonrails Rails=2.3.9

rubyonrails Rails=2.3.10

rubyonrails Rails=2.3.11

rubyonrails Rails=2.3.12

rubyonrails Rails=2.3.13

rubyonrails Rails=2.3.14

rubyonrails Rails=2.3.15

rubyonrails Rails=2.3.16

Remediation

Patch Available

http://www.openwall.com/lists/oss-security/2013/02/11/5

Event History

Feb 13, 2013

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Oct 24, 2017

Advisory Published

06:33 PM

Frequently Asked Questions

What is the severity of CVE-2013-0276?