CVE-2013-1756: Code Injection
Published Jun 9, 2014
·Updated
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
Affected Software
56 affected componentsFixes available
Mark Evans Dragonfly Gem=0.7.0
Mark Evans Dragonfly Gem=0.7.1
Mark Evans Dragonfly Gem=0.7.2
Mark Evans Dragonfly Gem=0.7.3
Mark Evans Dragonfly Gem=0.7.4
Mark Evans Dragonfly Gem=0.7.5
Mark Evans Dragonfly Gem=0.7.6
Mark Evans Dragonfly Gem=0.7.7
Mark Evans Dragonfly Gem=0.8.0
Mark Evans Dragonfly Gem=0.8.1
Mark Evans Dragonfly Gem=0.8.2
Mark Evans Dragonfly Gem=0.8.4
Mark Evans Dragonfly Gem=0.8.5
Mark Evans Dragonfly Gem=0.9.0
Mark Evans Dragonfly Gem=0.9.1
Mark Evans Dragonfly Gem=0.9.2
Mark Evans Dragonfly Gem=0.9.3
Mark Evans Dragonfly Gem=0.9.4
Mark Evans Dragonfly Gem=0.9.5
Mark Evans Dragonfly Gem=0.9.6
Mark Evans Dragonfly Gem=0.9.7
Mark Evans Dragonfly Gem=0.9.8
Mark Evans Dragonfly Gem=0.9.9
Mark Evans Dragonfly Gem=0.9.10
Mark Evans Dragonfly Gem=0.9.11
Mark Evans Dragonfly Gem=0.9.12
Ruby on Rails Ruby on Rails
rubygems/dragonfly>=0.9<0.9.13
0.9.13
rubygems/dragonfly>=0.7<0.8.6
0.8.6
All of the following
Any of the following
Mark Evans Dragonfly Gem=0.7.0
Mark Evans Dragonfly Gem=0.7.1
Mark Evans Dragonfly Gem=0.7.2
Mark Evans Dragonfly Gem=0.7.3
Mark Evans Dragonfly Gem=0.7.4
Mark Evans Dragonfly Gem=0.7.5
Mark Evans Dragonfly Gem=0.7.6
Mark Evans Dragonfly Gem=0.7.7
Mark Evans Dragonfly Gem=0.8.0
Mark Evans Dragonfly Gem=0.8.1
Mark Evans Dragonfly Gem=0.8.2
Mark Evans Dragonfly Gem=0.8.4
Mark Evans Dragonfly Gem=0.8.5
Mark Evans Dragonfly Gem=0.9.0
Mark Evans Dragonfly Gem=0.9.1
Mark Evans Dragonfly Gem=0.9.2
Mark Evans Dragonfly Gem=0.9.3
Mark Evans Dragonfly Gem=0.9.4
Mark Evans Dragonfly Gem=0.9.5
Mark Evans Dragonfly Gem=0.9.6
Mark Evans Dragonfly Gem=0.9.7
Mark Evans Dragonfly Gem=0.9.8
Mark Evans Dragonfly Gem=0.9.9
Mark Evans Dragonfly Gem=0.9.10
Mark Evans Dragonfly Gem=0.9.11
Mark Evans Dragonfly Gem=0.9.12
Ruby on Rails Ruby on Rails
Event History
Jun 9, 2014
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Oct 24, 2017
Advisory Published
via GitHub·06:33 PM
Data Sourced
via GitHub·06:33 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-1756?
CVE-2013-1756 has a high severity level due to its potential for remote code execution.
2
How do I fix CVE-2013-1756?
To fix CVE-2013-1756, upgrade to Dragonfly gem version 0.9.13 or 0.8.6.
3
What versions are affected by CVE-2013-1756?
CVE-2013-1756 affects Dragonfly gem versions prior to 0.8.6 and 0.9.x prior to 0.9.13.
4
Who is the vendor responsible for CVE-2013-1756?
The vendor responsible for CVE-2013-1756 is Mark Evans, the creator of the Dragonfly gem.
5
Can CVE-2013-1756 affect Ruby on Rails applications?
Yes, CVE-2013-1756 can impact Ruby on Rails applications that utilize the affected versions of the Dragonfly gem.