CVE-2013-0155
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
Key facts
- CVSS score
- 6.4 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:N- Weakness (CWE)
- CWE-264
- EPSS score
- 8.2% (95th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2017-0242)
- Published
- January 13, 2013
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2017-0242 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.
View on the EU Vulnerability DatabaseAffected products
- debian / debian linux
- rubyonrails / rails
- rubyonrails / ruby on rails
References
- http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A(Third Party Advisory, US Government Resource)
- http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html(Mailing List, Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-0154.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-0155.html(Third Party Advisory)
- http://support.apple.com/kb/HT5784(Third Party Advisory)
- http://www.debian.org/security/2013/dsa-2609(Third Party Advisory)
- https://groups.google.com/group/rubyonrails-security/msg/bc6f13dafe130ee9?dmode=source&output=gplain(Third Party Advisory)
- https://puppet.com/security/cve/cve-2013-0155(Third Party Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain