Skip to content
Fencer Intel
medium 6.4

CVE-2013-6417 json

actionpack allows bypass of database-query restrictions

published 12y ago modified 4mo ago also GHSA-wpw7-wxjm-cw8r , EUVD-2017-0324

cvss
6.4
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

Patch / fix

  • rubygems actionpack 3.2.16, 4.0.2
  • cfme cloudforms managementengine 5 5.2.3.2-1.el6cf
  • prince cloudforms managementengine 5 9.0r2-4.el6cf
  • cfme-lib cloudforms managementengine 5 5.2.3.2-1.el6cf
  • cfme-appliance cloudforms managementengine 5 5.2.3.2-1.el6cf
  • mingw32-cfme-host cloudforms managementengine 5 5.2.3.2-1.el6cf
  • postgresql92-postgresql cloudforms managementengine 5 9.2.7-1.1.el6
  • ruby193-rubygem-actionpack cloudforms managementengine 5 1:3.2.13-6.el6cf
  • postgresql92-postgresql-libs cloudforms managementengine 5 9.2.7-1.1.el6

red hat advisories RHSA-2014:0469RHSA-2014:0008RHSA-2013:1794

Is CVE-2013-6417 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2013-6417 updated cvss 6.4

rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)

  • Red Hat OpenShift Enterprise 1 ruby193-rubygem-actionpack
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 4 ruby193-rubygem-actionpack Red Hat Satellite 6 ruby193-rubygem-actionpack
    affected: no fix available
  • Red Hat Subscription Asset Manager rubygem-actionpack, ruby193-rubygem-actionpack
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Management Engine cfme 5.2.3.2-1.el6cf, prince 9.0r2-4.el6cf, cfme-lib 5.2.3.2-1.el6cf, cfme-appliance 5.2.3.2-1.el6cf, mingw32-cfme-host 5.2.3.2-1.el6cf, postgresql92-postgresql 9.2.7-1.1.el6, +9 more
    fixed: fixed in 9.2.7 RHSA-2014:0469
  • Red Hat Enterprise Linux OpenStack Platform 3.0 ruby193-rubygem-actionpack 3.2.8-5.1.el6
    fixed: vendor fix RHSA-2014:0008
  • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) ruby193-rubygem-actionpack 3.2.8-5.1.el6 Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) ruby193-rubygem-actionpack 3.2.8-5.1.el6
    fixed: vendor fix RHSA-2013:1794
  • Red Hat Software Collections ror40-rubygem-actionpack
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.37% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected packages

ecosystem package affected fixed in
rubygems actionpack
>=3.0.0, <3.2.16
>=4.0.0, <4.0.2
3.2.16
4.0.2

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls
  • CWE-284 Improper Access Control
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.