CVE-2013-6417
actionpack allows bypass of database-query restrictions
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
Exploit likelihood
What each source reports
NVD Score used
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
- Record
CVE-2013-6417- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
- Record
CVE-2013-6417- Updated
- 2026-11-02
EUVDEUVD-2017-0324 No score
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
- Record
EUVD-2017-0324- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wpw7-wxjm-cw8r No score
actionpack allows bypass of database-query restrictions
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
- Record
GHSA-wpw7-wxjm-cw8r- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-wpw7-wxjm-cw8r No score
actionpack allows bypass of database-query restrictions
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
- Record
GHSA-wpw7-wxjm-cw8r- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6417 No score
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
- Record
UBUNTU-CVE-2013-6417- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actionpackRubyGems |
3.0.0 up to 3.2.16 | 3.2.16 |
actionpackRubyGems |
4.0.0 up to 4.0.2 | 4.0.2 |
ruby-actionpack-3.2Debian:7 From an advisory covering 5 CVEs |
before 3.2.6-6+deb7u1, plus listed versions 3.2.6-6 |
3.2.6-6+deb7u1 |
actionpackRubyGems |
3.0.0 up to 3.2.16, plus listed versions 3.0.13.0.103.0.10.rc13.0.113.0.12 Show 45 moreShow less3.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.1.03.1.0.beta13.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.0.rc53.1.0.rc63.1.0.rc83.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.10 |
3.2.16 |
actionpackRubyGems |
4.0.0 up to 4.0.2, plus listed versions 4.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc4 |
4.0.2 |
ruby193-rubygem-actionpackRed Hat:rhel_software_collections:1::el6 From an advisory covering 4 CVEs |
before 1:3.2.8-5.1.el6 | 1:3.2.8-5.1.el6 |
ruby193-rubygem-actionpack-docRed Hat:rhel_software_collections:1::el6 From an advisory covering 4 CVEs |
before 1:3.2.8-5.1.el6 | 1:3.2.8-5.1.el6 |
ruby193-rubygem-actionpackRed Hat:openstack:3::el6 From an advisory covering 4 CVEs |
before 1:3.2.8-5.1.el6 | 1:3.2.8-5.1.el6 |
ruby193-rubygem-actionpack-docRed Hat:openstack:3::el6 From an advisory covering 4 CVEs |
before 1:3.2.8-5.1.el6 | 1:3.2.8-5.1.el6 |
cfmeRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:5.2.3.2-1.el6cf | 0:5.2.3.2-1.el6cf |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cfme-applianceRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:5.2.3.2-1.el6cf | 0:5.2.3.2-1.el6cf |
cfme-debuginfoRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:5.2.3.2-1.el6cf | 0:5.2.3.2-1.el6cf |
cfme-libRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:5.2.3.2-1.el6cf | 0:5.2.3.2-1.el6cf |
mingw32-cfme-hostRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:5.2.3.2-1.el6cf | 0:5.2.3.2-1.el6cf |
postgresql92-postgresqlRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:9.2.7-1.1.el6 | 0:9.2.7-1.1.el6 |
postgresql92-postgresql-contribRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:9.2.7-1.1.el6 | 0:9.2.7-1.1.el6 |
postgresql92-postgresql-debuginfoRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:9.2.7-1.1.el6 | 0:9.2.7-1.1.el6 |
postgresql92-postgresql-develRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:9.2.7-1.1.el6 | 0:9.2.7-1.1.el6 |
postgresql92-postgresql-docsRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:9.2.7-1.1.el6 | 0:9.2.7-1.1.el6 |
postgresql92-postgresql-libsRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:9.2.7-1.1.el6 | 0:9.2.7-1.1.el6 |
postgresql92-postgresql-plperlRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:9.2.7-1.1.el6 | 0:9.2.7-1.1.el6 |
postgresql92-postgresql-plpythonRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:9.2.7-1.1.el6 | 0:9.2.7-1.1.el6 |
postgresql92-postgresql-pltclRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:9.2.7-1.1.el6 | 0:9.2.7-1.1.el6 |
postgresql92-postgresql-serverRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:9.2.7-1.1.el6 | 0:9.2.7-1.1.el6 |
postgresql92-postgresql-testRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:9.2.7-1.1.el6 | 0:9.2.7-1.1.el6 |
postgresql92-postgresql-upgradeRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:9.2.7-1.1.el6 | 0:9.2.7-1.1.el6 |
princeRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 0:9.0r2-4.el6cf | 0:9.0r2-4.el6cf |
ruby193-rubygem-actionpackRed Hat:cloudforms_managementengine:5::el6 From an advisory covering 11 CVEs |
before 1:3.2.13-6.el6cf | 1:3.2.13-6.el6cf |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6417 is a medium vulnerability (CVSS 6.4) in Rubyonrails Rails, published December 7, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.37%, the 83rd percentile. Fixed in actionpack 3.2.16.
References
rhn.redhat.com/errata/RHSA-2014-0008.html
lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
groups.google.com/forum/message/raw?msg=ruby-security-ann/niK4drpSHT4/g8JW8ZsayRkJ
Show 76 moreShow less
weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
puppet.com/security/cve/cve-2013-6417
debian.org/security/2014/dsa-2888
nvd.nist.gov/vuln/detail/CVE-2013-6417
web.archive.org/web/20160806051251/https://puppet.com/security/cve/cve-2013-6417
github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6417.yml
access.redhat.com/errata/RHSA-2013:1794
bugzilla.redhat.com/show_bug.cgi?id=1036409
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1794.json
cve.org/CVERecord?id=CVE-2013-4491
ubuntu.com/security/CVE-2013-6417
openwall.com/lists/oss-security/2013/12/03/12
Left out here: 49 versions. The JSON record has them.