CVE-2013-1800
Last modified
CVE-2013-1800 is a vulnerability of currently unknown severity. The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.. EPSS estimates a 4.95% chance of exploitation in the next 30 days.
Description
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| John Nunemaker | Crack | <= 0.3.1 |
| John Nunemaker | Crack | 0.1.8 |
| John Nunemaker | Crack | 0.2.0 |
| John Nunemaker | Crack | 0.3.0 |
References
- http://secunia.com/advisories/52897Vendor Advisory
- http://secunia.com/advisories/52897Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-1800?
How severe is CVE-2013-1800?
How do I fix CVE-2013-1800?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-1794Buffer overflow in certain client utilities in OpenAFS befor…
- CVE-2013-1795Integer overflow in ptserver in OpenAFS before 1.6.2 allows …
- CVE-2013-1796The kvm_set_msr_common function in arch/x86/kvm/x86.c in the…
- CVE-2013-1797Use-after-free vulnerability in arch/x86/kvm/x86.c in the Li…
- CVE-2013-1798The ioapic_read_indirect function in virt/kvm/ioapic.c in th…
- CVE-2013-1799Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x bef…
- CVE-2013-1801The httparty gem 0.9.0 and earlier for Ruby does not properl…
- CVE-2013-1802The extlib gem 0.9.15 and earlier for Ruby does not properly…
- CVE-2013-1803Multiple SQL injection vulnerabilities in PHP-Fusion before …
- CVE-2013-1804Multiple cross-site scripting (XSS) vulnerabilities in PHP-F…
- CVE-2013-1805Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2013-1806Multiple directory traversal vulnerabilities in PHP-Fusion b…
Are you affected by CVE-2013-1800?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST