CVE-2013-6417: Medium severity rubyonrails Rails vulnerability

Q: What is the severity of CVE-2013-6417?

CVE-2013-6417 has a severity rating that allows remote attackers to bypass database-query restrictions.

Q: How do I fix CVE-2013-6417?

To fix CVE-2013-6417, you should upgrade to Ruby on Rails version 4.0.2 or 3.2.16 or later.

Q: What components are affected by CVE-2013-6417?

CVE-2013-6417 affects the actionpack component in Ruby on Rails versions prior to 4.0.2 and 3.2.16.

Q: Can CVE-2013-6417 affect database integrity?

Yes, CVE-2013-6417 can potentially allow unauthorized database queries, impacting database integrity.

Q: Is CVE-2013-6417 a critical vulnerability?

CVE-2013-6417 is considered a significant vulnerability due to the ability to bypass intended security measures.

Published Dec 7, 2013

Updated

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

Other sources

Affected Software

110 affected componentsFixes available

rubygems/actionpack>=4.0.0<4.0.2

4.0.2

rubygems/actionpack>=3.0.0<3.2.16

3.2.16

rubyonrails Rails=3.0.0

rubyonrails Rails=3.0.0-beta

rubyonrails Rails=3.0.0-beta2

rubyonrails Rails=3.0.0-beta3

rubyonrails Rails=3.0.0-beta4

rubyonrails Rails=3.0.0-rc

rubyonrails Rails=3.0.0-rc2

rubyonrails Rails=3.0.1

rubyonrails Rails=3.0.1-pre

rubyonrails Rails=3.0.2

rubyonrails Rails=3.0.2-pre

rubyonrails Rails=3.0.3

rubyonrails Rails=3.0.4-rc1

rubyonrails Rails=3.0.5

rubyonrails Rails=3.0.5-rc1

rubyonrails Rails=3.0.6

rubyonrails Rails=3.0.6-rc1

rubyonrails Rails=3.0.6-rc2

rubyonrails Rails=3.0.7

rubyonrails Rails=3.0.7-rc1

rubyonrails Rails=3.0.7-rc2

rubyonrails Rails=3.0.8

rubyonrails Rails=3.0.8-rc1

rubyonrails Rails=3.0.8-rc2

rubyonrails Rails=3.0.8-rc3

rubyonrails Rails=3.0.8-rc4

rubyonrails Rails=3.0.9

rubyonrails Rails=3.0.9-rc1

rubyonrails Rails=3.0.9-rc2

rubyonrails Rails=3.0.9-rc3

rubyonrails Rails=3.0.9-rc4

rubyonrails Rails=3.0.9-rc5

rubyonrails Rails=3.0.10

rubyonrails Rails=3.0.10-rc1

rubyonrails Rails=3.0.11

rubyonrails Rails=3.0.12

rubyonrails Rails=3.0.12-rc1

rubyonrails Rails=3.0.13

rubyonrails Rails=3.0.13-rc1

rubyonrails Rails=3.0.14

rubyonrails Rails=3.0.16

rubyonrails Rails=3.0.17

rubyonrails Rails=3.0.18

rubyonrails Rails=3.0.19

rubyonrails Rails=3.0.20

rubyonrails Rails=3.1.0

rubyonrails Rails=3.1.0-beta1

rubyonrails Rails=3.1.0-rc1

rubyonrails Rails=3.1.0-rc2

rubyonrails Rails=3.1.0-rc3

rubyonrails Rails=3.1.0-rc4

rubyonrails Rails=3.1.0-rc5

rubyonrails Rails=3.1.0-rc6

rubyonrails Rails=3.1.0-rc7

rubyonrails Rails=3.1.0-rc8

rubyonrails Rails=3.1.1

rubyonrails Rails=3.1.1-rc1

rubyonrails Rails=3.1.1-rc2

rubyonrails Rails=3.1.1-rc3

rubyonrails Rails=3.1.2

rubyonrails Rails=3.1.2-rc1

rubyonrails Rails=3.1.2-rc2

rubyonrails Rails=3.1.3

rubyonrails Rails=3.1.4

rubyonrails Rails=3.1.4-rc1

rubyonrails Rails=3.1.5

rubyonrails Rails=3.1.5-rc1

rubyonrails Rails=3.1.6

rubyonrails Rails=3.1.7

rubyonrails Rails=3.1.8

rubyonrails Rails=3.1.9

rubyonrails Rails=3.1.10

rubyonrails Rails=3.2.0

rubyonrails Rails=3.2.0-rc1

rubyonrails Rails=3.2.0-rc2

rubyonrails Rails=3.2.1

rubyonrails Rails=3.2.2

rubyonrails Rails=3.2.2-rc1

rubyonrails Rails=3.2.3

rubyonrails Rails=3.2.3-rc1

rubyonrails Rails=3.2.3-rc2

rubyonrails Rails=3.2.4

rubyonrails Rails=3.2.4-rc1

rubyonrails Rails=3.2.5

rubyonrails Rails=3.2.6

rubyonrails Rails=3.2.7

rubyonrails Rails=3.2.8

rubyonrails Rails=3.2.9

rubyonrails Rails=3.2.10

rubyonrails Rails=3.2.11

rubyonrails Rails=3.2.12

rubyonrails Rails=3.2.13

rubyonrails Rails=3.2.13-rc1

rubyonrails Rails=3.2.13-rc2

rubyonrails ruby on Rails<=3.2.15

rubyonrails ruby on Rails=3.0.4

rubyonrails ruby on Rails=3.1.11

rubyonrails ruby on Rails=3.2.14

rubyonrails ruby on Rails=3.2.14-rc1

rubyonrails ruby on Rails=3.2.14-rc2

rubyonrails ruby on Rails=3.2.15-rc1

rubyonrails ruby on Rails=3.2.15-rc2

rubyonrails Rails<=4.0.1

rubyonrails Rails=4.0.0

rubyonrails Rails=4.0.0-beta

rubyonrails Rails=4.0.0-rc1

rubyonrails Rails=4.0.0-rc2

rubyonrails Rails=4.0.1-rc1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rubygems/actionpack to a version that resolves this vulnerability.
Fixed in 4.0.2
Upgrade
Upgrade rubygems/actionpack to a version that resolves this vulnerability.
Fixed in 3.2.16
Upgrade
Upgrade Ruby on Rails to a version that resolves this vulnerability.
Fixed in 3.2.16
Upgrade
Upgrade Ruby on Rails to a version that resolves this vulnerability.
Fixed in 4.0.2

Event History

Dec 7, 2013

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·12:55 AM

DescriptionSeverityWeaknessAffected Software

Oct 24, 2017

Advisory Published

06:33 PM

Frequently Asked Questions

What is the severity of CVE-2013-6417?

CVE-2013-6417 has a severity rating that allows remote attackers to bypass database-query restrictions.

How do I fix CVE-2013-6417?

To fix CVE-2013-6417, you should upgrade to Ruby on Rails version 4.0.2 or 3.2.16 or later.

What components are affected by CVE-2013-6417?