CVE-2013-0277
rubyonrails: no CVSS score yet. EPSS 7.5% chance of exploitation in the next 30 days. Fixed in activerecord 2.3.17, 3.1.0.
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
- EPSS
- 7.5% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rubyonrails:rails
- rubyonrails:ruby_on_rails
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fhj9-cjjh-27vm | RubyGems | activerecord | <2.3.17 | 2.3.17 |
| GHSA-fhj9-cjjh-27vm | RubyGems | activerecord | >=3.0.0 <3.1.0 | 3.1.0 |