CVE-2013-1756

The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.

Published: Jun 9, 2014
Updated: Nov 8, 2023
CVE: CVE-2013-1756
GHSA: GHSA-p463-639r-q9g9
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-94

Affected Software
References

Software	From	Fixed in
mark_evans / dragonfly_gem	0.7.0	0.7.0.x
mark_evans / dragonfly_gem	0.7.1	0.7.1.x
mark_evans / dragonfly_gem	0.7.2	0.7.2.x
mark_evans / dragonfly_gem	0.7.3	0.7.3.x
mark_evans / dragonfly_gem	0.7.4	0.7.4.x
mark_evans / dragonfly_gem	0.7.5	0.7.5.x
mark_evans / dragonfly_gem	0.7.6	0.7.6.x
mark_evans / dragonfly_gem	0.7.7	0.7.7.x
mark_evans / dragonfly_gem	0.8.0	0.8.0.x
mark_evans / dragonfly_gem	0.8.1	0.8.1.x
mark_evans / dragonfly_gem	0.8.2	0.8.2.x
mark_evans / dragonfly_gem	0.8.4	0.8.4.x
mark_evans / dragonfly_gem	0.8.5	0.8.5.x
mark_evans / dragonfly_gem	0.9.0	0.9.0.x
mark_evans / dragonfly_gem	0.9.1	0.9.1.x
mark_evans / dragonfly_gem	0.9.2	0.9.2.x
mark_evans / dragonfly_gem	0.9.3	0.9.3.x
mark_evans / dragonfly_gem	0.9.4	0.9.4.x
mark_evans / dragonfly_gem	0.9.5	0.9.5.x
mark_evans / dragonfly_gem	0.9.6	0.9.6.x
mark_evans / dragonfly_gem	0.9.7	0.9.7.x
mark_evans / dragonfly_gem	0.9.8	0.9.8.x
mark_evans / dragonfly_gem	0.9.9	0.9.9.x
mark_evans / dragonfly_gem	0.9.10	0.9.10.x
mark_evans / dragonfly_gem	0.9.11	0.9.11.x
mark_evans / dragonfly_gem	0.9.12	0.9.12.x
dragonfly	0.7	0.8.6
dragonfly	0.9	0.9.13

Vulnerability Database

289,697

CVE-2013-1756