Advisory details:
github_osv / GHSA-mpxf-gcw2-pw5q
| Advisory ID | github_osv/GHSA-mpxf-gcw2-pw5q |
| Aliases |
CVE-2013-6414
|
| Summary | actionpack Improper Input Validation vulnerability `actionpack/lib/action_view/lookup_context.rb` in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| generic_textual | MODERATE |
| Data source | Metasploit |
|---|---|
| Description | This module exploits a Denial of Service (DoS) condition in Action View that requires a controller action. By sending a specially crafted content-type header to a Rails application, it is possible for it to store the invalid MIME type, and may eventually consume all memory if enough invalid MIMEs are given. Versions 3.0.0 and other later versions are affected, fixed in 4.0.2 and 3.2.16. |
| Note | Stability: - crash-service-down SideEffects: [] Reliability: [] |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 4, 2013 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/dos/http/rails_action_view.rb |
| Data source | Metasploit |
|---|---|
| Description | This module exploits a Denial of Service (DoS) condition in Action View that requires a controller action. By sending a specially crafted content-type header to a Rails application, it is possible for it to store the invalid MIME type, and may eventually consume all memory if enough invalid MIMEs are given. Versions 3.0.0 and other later versions are affected, fixed in 4.0.2 and 3.2.16. |
| Note | Stability: - crash-service-down SideEffects: [] Reliability: [] |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 4, 2013 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/dos/http/rails_action_view.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no known vectors.
There are no SSVC decisions available.