CVE-2013-0285

Published: Apr 9, 2013Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.

Affected (9)

Products: Nori Gem Project: Nori Gem

Nori Gem Project

1 product

Nori Gem

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Nori Gem Project Nori Gem	Version 2.0.0
Nori Gem Project Nori Gem	Version 2.0.1

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Nori Gem Project Nori Gem	Version 1.1.0
Nori Gem Project Nori Gem	Version 1.1.1
Nori Gem Project Nori Gem	Version 1.1.2
Nori Gem Project Nori Gem	Version 1.1.3