Advisory details:
gitlab / gem/rails/CVE-2013-6414
| Advisory ID | gitlab/gem/rails/CVE-2013-6414 |
| Aliases |
CVE-2013-6414
|
| Summary | Denial of Service Vulnerability in Action View There is a denial of service vulnerability in the header handling component of Action View. Strings sent in specially crafted headers will be cached indefinitely. This can cause the cache to grow infinitely, which will eventually consume all memory on the target machine, causing a denial of service. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv2 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/rails/CVE-2013-6414.yml |
| Reference id | Reference type | URL |
|---|---|---|
| http://seclists.org/oss-sec/2013/q4/400 |
| Data source | Metasploit |
|---|---|
| Description | This module exploits a Denial of Service (DoS) condition in Action View that requires a controller action. By sending a specially crafted content-type header to a Rails application, it is possible for it to store the invalid MIME type, and may eventually consume all memory if enough invalid MIMEs are given. Versions 3.0.0 and other later versions are affected, fixed in 4.0.2 and 3.2.16. |
| Note | Stability: - crash-service-down SideEffects: [] Reliability: [] |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 4, 2013 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/dos/http/rails_action_view.rb |
| Data source | Metasploit |
|---|---|
| Description | This module exploits a Denial of Service (DoS) condition in Action View that requires a controller action. By sending a specially crafted content-type header to a Rails application, it is possible for it to store the invalid MIME type, and may eventually consume all memory if enough invalid MIMEs are given. Versions 3.0.0 and other later versions are affected, fixed in 4.0.2 and 3.2.16. |
| Note | Stability: - crash-service-down SideEffects: [] Reliability: [] |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 4, 2013 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/dos/http/rails_action_view.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
There are no SSVC decisions available.