CVE-2013-6414

medium · 5

actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.

CVSS

20.7%

EPSS (exploit prob.)

97th

EPSS percentile

2013-12-07

Published

AV:N/AC:L/Au:N/C:N/I:N/A:P

Weaknesses

CWE-20

Affected products

Vendor	Product	Affected versions
rubyonrails	rails	<= 4.0.1
rubyonrails	rails	4.0.0
rubyonrails	rails	4.0.0
rubyonrails	rails	4.0.0
rubyonrails	rails	4.0.0
rubyonrails	rails	4.0.1
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.0
rubyonrails	rails	3.0.1
rubyonrails	rails	3.0.1
rubyonrails	rails	3.0.2
rubyonrails	rails	3.0.2
rubyonrails	rails	3.0.3
rubyonrails	rails	3.0.4
rubyonrails	rails	3.0.5
rubyonrails	rails	3.0.5
rubyonrails	rails	3.0.6
rubyonrails	rails	3.0.6
rubyonrails	rails	3.0.6
rubyonrails	rails	3.0.7
rubyonrails	rails	3.0.7
rubyonrails	rails	3.0.7
rubyonrails	rails	3.0.8
rubyonrails	rails	3.0.8
rubyonrails	rails	3.0.8
rubyonrails	rails	3.0.8
rubyonrails	rails	3.0.8
rubyonrails	rails	3.0.9
rubyonrails	rails	3.0.9
rubyonrails	rails	3.0.9
rubyonrails	rails	3.0.9
rubyonrails	rails	3.0.9
rubyonrails	rails	3.0.9
rubyonrails	rails	3.0.10
rubyonrails	rails	3.0.10

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-6414