CVE-2013-0175

multi_xml < 0.5.2 - Remote Code Execution via YAML/Symbol Type Conversion

Title source: llm
STIX 2.1

Description

multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.

References (5)

Core 5
Core References
Various Sources x_refsource_misc
https://news.ycombinator.com/item?id=5040457
Issue Tracking x_refsource_confirm
https://github.com/sferik/multi_xml/pull/34
Various Sources x_refsource_confirm
https://gist.github.com/nate/d7f6d9f4925f413621aa
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/01/11/9

Scores

EPSS 0.0126
EPSS Percentile 79.7%

Details

CWE
CWE-20
Status published
Products (14)
erik_michaels-ober/multi_xml 0.5.2
grape_project/grape 0.1.0
grape_project/grape 0.1.1
grape_project/grape 0.1.2
grape_project/grape 0.1.3
grape_project/grape 0.1.4
grape_project/grape 0.1.5
grape_project/grape 0.2.0
grape_project/grape 0.2.1
grape_project/grape 0.2.2
... and 4 more
Published Apr 25, 2013
Tracked Since Feb 18, 2026