VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 19, 2013· Updated Jun 16, 2026

CVE-2013-1856

CVE-2013-1856

Description

The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
activesupportRubyGems
>= 3.0.0, < 3.1.123.1.12
activesupportRubyGems
>= 3.2.0, < 3.2.133.2.13

Affected products

48
  • Rubyonrails/Rails46 versions
    cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*+ 45 more
    • cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*
    • cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*
  • Rubyonrails/Ruby on Rails
    cpe:2.3:a:rubyonrails:ruby_on_rails:3.1.11:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:gem/activesupport
    Range: >= 3.0.0, < 3.1.12

Patches

Vulnerability mechanics

References

11

News mentions

0

No linked articles in our index yet.