CVE-2013-3221
Active Record component in Ruby on Rails has a data-type injection vulnerability
CVE-2013-3221 is a medium vulnerability (CVSS 6.4) in Rubyonrails Rails, published April 22, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.40%, the 84th percentile. Fixed in activerecord 4.2.0.
- Severity
- 6.4 MediumCVSS 2.0, NVD
- Exploit chance
- 2.40%EPSS, 84th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.2.0activerecord +4 more
Description
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecordRubyGems | before 4.2.0 | 4.2.0 |
railsDebian:12 | before 2.3.14.1 | 2.3.14.1 |
railsDebian:13 | before 2.3.14.1 | 2.3.14.1 |
railsDebian:14 | before 2.3.14.1 | 2.3.14.1 |
activerecordRubyGems | before 4.2.0, plus listed versions 1.0.01.1.01.10.01.10.11.11.0 Show 45 moreShow less1.11.11.12.11.12.21.13.01.13.11.13.21.14.01.14.11.14.21.14.31.14.41.15.01.15.11.15.21.15.31.15.41.15.51.15.61.2.01.3.01.4.01.5.01.5.11.6.01.7.01.8.01.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.152.3.162.3.17 | 4.2.0 |
What each source reports
NVD Score used
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
CVE-2013-3221- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
CVE-2013-3221- Updated
- 2026-11-02
EUVDEUVD-2013-3159No score
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
EUVD-2013-3159- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f57c-hx33-hvh8
Active Record component in Ruby on Rails has a data-type injection vulnerability
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
GHSA-f57c-hx33-hvh8- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20, CWE-89
- Updated
- 2026-11-02
OSVGHSA-f57c-hx33-hvh8
Active Record component in Ruby on Rails has a data-type injection vulnerability
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
GHSA-f57c-hx33-hvh8- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20, CWE-89
- Updated
- 2026-11-02
OSVNo score
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
CVE-2013-3221- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-3221No score
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
DEBIAN-CVE-2013-3221- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
pl.reddit.com/r/netsec/comments/17yajp/mysql_madness_and_rails
groups.google.com/group/rubyonrails-security/msg/1f3bc0b88a60c1ce?dmode=source&output=gplain
phenoelit.org/blog/archives/2013/02/index.html
openwall.com/lists/oss-security/2013/04/24/7
gist.github.com/dakull/5442275
Show 6 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-3221
github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2013-3221.yml
web.archive.org/web/20130825191249/http://www.phenoelit.org/blog/archives/2013/02/index.html
security-tracker.debian.org/tracker/CVE-2013-3221
Left out here: 205 versions. The JSON record has them.