XML Parsing Flaw in Ruby on Rails Active Support Component

CVE-2013-1856

What is CVE-2013-1856?

In Ruby on Rails, the ActiveSupport::XmlMini_JDOM backend is vulnerable when used with JRuby, failing to properly restrict XML parser capabilities. This flaw allows remote attackers to exploit the application, potentially leading to unauthorized access to sensitive files or triggering denial of service through resource exhaustion via external DTDs or entity references.

References