{
"id": "GHSA-p463-639r-q9g9",
"aliases": [
"CVE-2013-1756"
],
"details": "The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.",
"summary": "Dragonfly Code Injection vulnerability",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.7"
},
{
"fixed": "0.8.6"
}
]
}
],
"package": {
"name": "dragonfly",
"ecosystem": "RubyGems"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.9"
},
{
"fixed": "0.9.13"
}
]
}
],
"package": {
"name": "dragonfly",
"ecosystem": "RubyGems"
}
}
],
"modified": "2025-04-14T21:47:15Z",
"severity": [],
"published": "2017-10-24T18:33:37Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1756",
"type": "ADVISORY"
},
{
"url": "https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277",
"type": "WEB"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82476",
"type": "WEB"
},
{
"url": "https://github.com/markevans/dragonfly",
"type": "PACKAGE"
},
{
"url": "https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo",
"type": "WEB"
},
{
"url": "https://web.archive.org/web/20200229103538/http://www.securityfocus.com/bid/58225",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2014-06-09T19:55:06Z",
"github_reviewed_at": "2020-06-16T21:47:55Z"
}
}