GHSA-mpxf-gcw2-pw5q · Severity: medium · Ecosystem: rubygems — actionpack Improper Input Validation vulnerability
actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
Conclusion & alert: CVE-2013-6414 is rated Moderate Risk (52/100): CVSS Medium severity, with high exploitation likelihood (EPSS 70.84%, 99th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-03-30 | 73.36% | 70.84% | -2.52% |
| 2 | 2025-03-29 | 70.84% | 73.36% | +2.52% |
| 3 | 2025-03-17 | — | 70.84% | — |
Full EPSS history (9 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.0 | 2.0 | MEDIUM |
|
10.0 | 2.9 | [email protected] |
GHSA-mpxf-gcw2-pw5q · Severity: medium · Ecosystem: rubygems — actionpack Improper Input Validation vulnerability
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
unimportant | CVE-2013-6414 unimportant priority: Debian including 1 source packages (rails), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2013-6414 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2013-6414 |
ubuntu
|
medium | CVE-2013-6414 medium priority: Ubuntu including 7 source packages (rails, ruby-actionpack-2.3, …), 105 status rows across 15 suites (artful, bionic, lucid, precise, quantal, raring, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): DNE 65, not-affected 32, ignored 6, released 2. | https://ubuntu.com/security/CVE-2013-6414 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| rubyonrails | rails | <= 4.0.1 | cpe:2.3:a:rubyonrails:rails:*:-:*:*:*:*:*:* |
| rubyonrails | rails | 4.0.0 | cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:* |
| rubyonrails | rails | 4.0.0 | cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:* |
| rubyonrails | rails | 4.0.0 | cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 4.0.0 | cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:* |
| rubyonrails | rails | 4.0.1 | cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.0 | cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.0 | cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.0 | cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.0 | cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.0 | cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.0 | cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.0 | cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.1 | cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.1 | cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.2 | cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.2 | cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.3 | cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.4 | cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.5 | cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.5 | cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.6 | cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.6 | cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.6 | cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.7 | cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.7 | cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.7 | cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.8 | cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.8 | cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.8 | cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.8 | cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.8 | cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.9 | cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.9 | cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.9 | cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.9 | cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.9 | cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.9 | cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.10 | cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.10 | cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.11 | cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.12 | cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.12 | cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.13 | cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.13 | cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.14 | cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.16 | cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.17 | cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.18 | cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.19 | cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.0.20 | cpe:2.3:a:rubyonrails:rails:3.0.20:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.0 | cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.0 | cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.0 | cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.0 | cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.0 | cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.0 | cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.0 | cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.0 | cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.0 | cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.0 | cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.1 | cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.1 | cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.1 | cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.1 | cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.2 | cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.2 | cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.2 | cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.3 | cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.4 | cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.4 | cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.5 | cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.5 | cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.6 | cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.7 | cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.8 | cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.9 | cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.1.10 | cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.2.0 | cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:* |
| rubyonrails | rails | 3.2.0 | cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:* |