CVEvulnerability

CVE-2021-33621

8.8 HIGH Published 2022-11-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-11-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74

Description

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

Affected configurations

• ruby-lang cgi (< 0.1.0.2) • ruby-lang cgi (>= 0.2.0 < 0.2.2) • ruby-lang cgi (>= 0.3.0 < 0.3.5) • fedoraproject fedora 35 • fedoraproject fedora 36 • fedoraproject fedora 37 • ruby-lang ruby (>= 2.7.0 < 2.7.7) • ruby-lang ruby (>= 3.0.0 < 3.0.5) • ruby-lang ruby (>= 3.1.0 < 3.1.3)

Related

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References