CVE-2013-0155

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.

• CWE-264

• http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01AThird Party Advisory, US Government Resource
• http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0154.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0155.htmlThird Party Advisory
• http://support.apple.com/kb/HT5784Third Party Advisory
• http://www.debian.org/security/2013/dsa-2609Third Party Advisory
• https://groups.google.com/group/rubyonrails-security/msg/bc6f13dafe130ee9?dmode=source&output=gplainThird Party Advisory
• https://puppet.com/security/cve/cve-2013-0155Third Party Advisory
• http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01AThird Party Advisory, US Government Resource
• http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0154.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0155.htmlThird Party Advisory
• http://support.apple.com/kb/HT5784Third Party Advisory
• http://www.debian.org/security/2013/dsa-2609Third Party Advisory
• https://groups.google.com/group/rubyonrails-security/msg/bc6f13dafe130ee9?dmode=source&output=gplainThird Party Advisory
• https://puppet.com/security/cve/cve-2013-0155Third Party Advisory

Published

Jan 13, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-0149The OSPF implementation in Cisco IOS 12.0 through 12.4 and 1…
• CVE-2013-0150Directory traversal vulnerability in an unspecified signed J…
• CVE-2013-0151The do_hvm_op function in xen/arch/x86/hvm/hvm.c in Xen 4.2.…
• CVE-2013-0152Memory leak in Xen 4.2 and unstable allows local HVM guests …
• CVE-2013-0153The AMD IOMMU support in Xen 4.2.x, 4.1.x, 3.3, and other ve…
• CVE-2013-0154The get_page_type function in xen/arch/x86/mm.c in Xen 4.2, …
• CVE-2013-0156active_support/core_ext/hash/conversions.rb in Ruby on Rails…
• CVE-2013-0157(a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and p…
• CVE-2013-0158Unspecified vulnerability in Jenkins before 1.498, Jenkins L…
• CVE-2013-0159The fedora-business-cards package before 1-0.1.beta1.fc17 on…
• CVE-2013-0160The Linux kernel through 3.7.9 allows local users to obtain …
• CVE-2013-0161Havalite CMS 1.1.7 has a stored XSS vulnerability5.4