TI-2013-00090 Aliases CVE-2013-0155 GHSA-gppp-5xc5-wfpx

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not…

LOW 39CWE-264Published 2013-01-13 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Partial · Partial · None
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264.

Summary

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.

Why it matters now

EPSS 0.08245 94th percentileScored 2026-11-07

Fix Fixed activerecord (RubyGems): 3.0.19, 3.1.10, 3.2.11Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	activerecord (RubyGems)	3.0.0 to before 3.0.19	3.0.19	Patch available	GHSA-gppp-5xc5-wfpx
—	activerecord (RubyGems)	3.1.0 to before 3.1.10	3.1.10	Patch available	GHSA-gppp-5xc5-wfpx
—	activerecord (RubyGems)	3.2.0 to before 3.2.11	3.2.11	Patch available	GHSA-gppp-5xc5-wfpx

— Vendor— Affected all versions Fixed in — No fix listed CNA
activerecord (RubyGems) Vendor— Affected 3.0.0 to before 3.0.19 Fixed in 3.0.19 Patch available GHSA-gppp-5xc5-wfpx
activerecord (RubyGems) Vendor— Affected 3.1.0 to before 3.1.10 Fixed in 3.1.10 Patch available GHSA-gppp-5xc5-wfpx
activerecord (RubyGems) Vendor— Affected 3.2.0 to before 3.2.11 Fixed in 3.2.11 Patch available GHSA-gppp-5xc5-wfpx

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:rubyonrails:rails::::::::	3.2.0 to before 3.2.11	Vulnerable	Rails
cpe:2.3:a:rubyonrails:ruby_on_rails::::::::	3.0.0 to before 3.0.19; 3.1.0 to before 3.1.10	Vulnerable	Rails
cpe:2.3:o:debian:debian_linux:6.0:::::::*	6.0	Vulnerable	Debian

cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* Versions 3.2.0 to before 3.2.11 Vulnerable ·Rails
cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.0.19; 3.1.0 to before 3.1.10 Vulnerable ·Rails
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Debian

Remediation

Fix · GHSA-gppp-5xc5-wfpx activerecord (RubyGems) Fixed in 3.0.19 Advisory →
Fix · GHSA-gppp-5xc5-wfpx activerecord (RubyGems) Fixed in 3.1.10 Advisory →
Fix · GHSA-gppp-5xc5-wfpx activerecord (RubyGems) Fixed in 3.2.11 Advisory →

Red Hat 3 advisories

RHSA-2013:0582 Released 2013-02-28 · Red Hat rating Moderate
Red Hat OpenShift Enterprise 1.1.1 update
- Red Hat OpenShift Enterprise Infrastructure graphviz-2.26.0-10.el6, graphviz-devel-2.26.0-10.el6, graphviz-doc-2.26.0-10.el6 +42
- Red Hat OpenShift Enterprise JBoss EAP add-on openshift-origin-cartridge-jbosseap-6.0-1.0.4-1.el6op
- Red Hat OpenShift Enterprise Node openshift-origin-cartridge-cron-1.4-1.0.3-1.el6op, openshift-origin-cartridge-diy-0.1-1.0.3-1.el6op, openshift-origin-cartridge-haproxy-1.4-1.0.4-1.el6op +46
RHSA-2013:0155 Released 2013-01-10 · Red Hat rating Critical
Ruby on Rails security update
- CloudForms Cloud Engine for RHEL 6 Server rubygem-actionpack-1:3.0.10-11.el6cf, rubygem-activerecord-1:3.0.10-8.el6cf, rubygem-activesupport-1:3.0.10-5.el6cf
- CloudForms System Engine for RHEL 6 Server rubygem-actionpack-1:3.0.10-11.el6cf, rubygem-activerecord-1:3.0.10-8.el6cf, rubygem-activesupport-1:3.0.10-5.el6cf
RHSA-2013:0154 Released 2013-01-10 · Red Hat rating Critical
Ruby on Rails security update
- Red Hat Subscription Asset Manager for RHEL 6 Server rubygem-actionpack-1:3.0.10-11.el6cf, rubygem-activerecord-1:3.0.10-8.el6cf, rubygem-activesupport-1:3.0.10-5.el6cf

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
CloudForms Cloud Engine for RHEL 6 Server	Fixed	RHSA-2013:0155
CloudForms System Engine for RHEL 6 Server	Fixed	RHSA-2013:0155
Red Hat OpenShift Enterprise Infrastructure	Fixed	RHSA-2013:0582
Red Hat OpenShift Enterprise JBoss EAP add-on	Fixed	RHSA-2013:0582
Red Hat OpenShift Enterprise Node	Fixed	RHSA-2013:0582
Red Hat Subscription Asset Manager for RHEL 6 Server	Fixed	RHSA-2013:0154

Timeline

2026-10-02 Threatist record created from CVE-2013-0155
2026-10-03 Alias added: GHSA-gppp-5xc5-wfpx

References

Advisory 13

Other 1

https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2013-0155.yml

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences