CVE-2013-1856

The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12…

published March 19, 2013

CVSS
—
EPSS
2%
Percentile
81.1
In the wild
Unconfirmed
What it is

The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02054 · 81.1th percentile
Published
2013-03-19T22:00Z
EPSS history
Timeline
  • 19 MAR 22:00Z
    The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12…
    cvelistv5