{"id":"CVE-2013-0333","aliases":["DEBIAN-CVE-2013-0333","DSA-2613-1","EUVD-2017-0331","GHSA-xgr2-v94m-rc9g","RHSA-2013:0202"],"status":"published","title":"activesupport in Rails vulnerable to incorrect data conversion","description":"lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.95573,"percentile":0.9987,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-74"],"published":"2013-01-29T00:00:00Z","modified":"2026-09-01T20:03:11Z","exploits":[{"source":"exploitdb","id":"EDB-24434","title":"Ruby on Rails - JSON Processor YAML Deserialization Code Execution (Metasploit)","type":"remote","platform":"multiple","date":"2013-01-29","verified":true,"url":"https://www.exploit-db.com/exploits/24434"},{"source":"metasploit","id":"auxiliary/scanner/http/rails_json_yaml_scanner","title":"Ruby on Rails JSON Processor YAML Deserialization Scanner","type":"auxiliary","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/rails_json_yaml_scanner"},{"source":"metasploit","id":"exploit/multi/http/rails_json_yaml_code_exec","title":"Ruby on Rails JSON Processor YAML Deserialization Code Execution","type":"exploit","platform":"Ruby","date":"2013-01-28","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/rails_json_yaml_code_exec"},{"source":"pocgithub","id":"heroku/heroku-CVE-2013-0333","title":"heroku/heroku-CVE-2013-0333","date":"2013-01-29","url":"https://github.com/heroku/heroku-CVE-2013-0333"}],"fixes":[{"ecosystem":"RubyGems","package":"activesupport","fixed_in":["2.3.16","3.0.20"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2.3.14.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2.3.14.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2.3.14.1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"rails","fixed_in":["2.3.5-1.2+squeeze6"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-activesupport","fixed_in":["1:3.0.13-4.el6op"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.2"},{"fixed":"2.3.16"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.20"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.14.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.14.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.14.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.5-1.2+squeeze6"}]}],"versions":["2.3.5-1.2","2.3.5-1.2+squeeze0.1","2.3.5-1.2+squeeze1","2.3.5-1.2+squeeze2","2.3.5-1.2+squeeze3","2.3.5-1.2+squeeze4","2.3.5-1.2+squeeze4.1","2.3.5-1.2+squeeze5"]},{"source":"osv","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.2"},{"fixed":"2.3.16"}]}],"versions":["2.3.10","2.3.11","2.3.12","2.3.14","2.3.15","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.6.pre","2.3.7","2.3.8","2.3.8.pre1","2.3.9","2.3.9.pre"]},{"source":"osv","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.20"}]}],"versions":["3.0.0","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5"]},{"source":"osv","ecosystem":"Red Hat:openshift:1::el6","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.13-4.el6op"}]}]}],"products":[{"vendor":"rubyonrails","product":"rails"},{"vendor":"rubyonrails","product":"ruby_on_rails"}],"references":[{"url":"http://www.kb.cert.org/vuls/id/628463","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource","web"]},{"url":"http://www.debian.org/security/2013/dsa-2613","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://support.apple.com/kb/HT5784","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"https://groups.google.com/group/rubyonrails-security/msg/52179af76915e518?dmode=source\u0026output=gplain","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0201.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0202.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://puppet.com/security/cve/cve-2013-0333","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0203.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0333","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xgr2-v94m-rc9g","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0201","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0202","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0203","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0333","tags":["web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=903440","tags":["web","report"]},{"url":"https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/1h2DR63ViGo","tags":["web","article"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2013-0333.yml","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-0333","tags":["advisory"]},{"url":"http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0202.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0333","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-0333","description":"lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.","status":"published","published":"2013-01-30T11:00:00Z","modified":"2024-08-06T14:25:09.069Z","updated_at":"2026-11-02T14:34:59.551717Z"}],"euvd":[{"id":"EUVD-2017-0331","description":"lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.","status":"published","published":"2013-01-30T11:00:00Z","modified":"2024-08-06T14:25:09Z","updated_at":"2026-11-03T01:56:45.291032Z"}],"ghsa":[{"id":"GHSA-xgr2-v94m-rc9g","title":"activesupport in Rails vulnerable to incorrect data conversion","description":"`lib/active_support/json/backends/yaml.rb` in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2023-08-25T20:10:52Z","cwes":["CWE-74"],"updated_at":"2026-11-02T14:37:00.680009Z"}],"nvd":[{"id":"CVE-2013-0333","description":"lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.","status":"published","published":"2013-01-30T12:00:08.93Z","modified":"2026-06-16T23:49:12.87Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:02:21.222658Z"}],"osv":[{"id":"CVE-2013-0333","description":"lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.","status":"published","published":"2013-01-30T12:00:08Z","modified":"2026-04-10T03:44:22.500102Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-0333","description":"lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.","status":"published","published":"2013-01-30T12:00:08.93Z","modified":"2026-09-01T20:03:11.368400416Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"DSA-2613-1","title":"rails - insufficient input validation","status":"published","published":"2013-01-29T00:00:00Z","modified":"2026-03-09T01:20:18.54585Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"GHSA-xgr2-v94m-rc9g","title":"activesupport in Rails vulnerable to incorrect data conversion","description":"`lib/active_support/json/backends/yaml.rb` in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2024-11-29T05:42:00.627143Z","cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"RHSA-2013:0202","title":"Red Hat Security Advisory: rubygem-activesupport security update","status":"published","published":"2024-09-15T20:33:44Z","modified":"2026-01-29T10:55:45.492389Z","updated_at":"2026-11-02T15:53:01.495018Z"}]}}