What’s Vulnerable › Vulnerabilities

CVE-2013-1756

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-06-09 · updated 2026-06-16
• Weakness: CWE-94

Description

The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.

Affected products

• Mark Evans Dragonfly Gem: 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5 (+20)

References

• http://secunia.com/advisories/52380
• http://www.securityfocus.com/bid/58225
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82476
• https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277
• https://groups.google.com/forum/?fromgroups=#%21topic/dragonfly-users/3c3WIU3VQTo
• http://secunia.com/advisories/52380
• http://www.securityfocus.com/bid/58225
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82476
• https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277
• https://groups.google.com/forum/?fromgroups=#%21topic/dragonfly-users/3c3WIU3VQTo

Get alerted when CVE-2013-1756 or the next vulnerability affects your stack