Description

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.

Remediation

References

CVE-2013-1854

Related Vulnerabilities

WordPress Plugin Quick Cache (Speed Without Compromise) Unspecified Vulnerability (140725)

WordPress Plugin ProfileGrid-User Profiles, Groups and Communities Unspecified Vulnerability (2.6.4)

SharePoint Use After Free Vulnerability (CVE-2025-62555)

WordPress Plugin WP Legal Pages Cross-Site Scripting (1.0.1)

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-9466)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2013-1854