What’s Vulnerable › Vulnerabilities

CVE-2013-0155

• Severity: medium (CVSS 6.4 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-01-13 · updated 2026-06-16
• Weakness: CWE-264

Description

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.

Affected products

• Debian Linux: 6.0
• Ruby on Rails: from 3.2.0 before 3.2.11 — fixed in 3.2.11
• rubyonrails Ruby On Rails: from 3.0.0 before 3.0.19; from 3.1.0 before 3.1.10 — fixed in 3.0.19, 3.1.10

How to fix

Upgrade to a fixed version: Ruby on Rails 3.2.11; rubyonrails Ruby On Rails 3.0.19, 3.1.10. Check the vendor advisory for mitigations.

References

• http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A
• http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
• http://rhn.redhat.com/errata/RHSA-2013-0154.html
• http://rhn.redhat.com/errata/RHSA-2013-0155.html
• http://support.apple.com/kb/HT5784
• http://www.debian.org/security/2013/dsa-2609
• https://groups.google.com/group/rubyonrails-security/msg/bc6f13dafe130ee9?dmode=source&output=gplain
• https://puppet.com/security/cve/cve-2013-0155

Get alerted when CVE-2013-0155 or the next vulnerability affects your stack