GitHub Advisoryadvisory · RubyGems

GHSA-369m-2gv6-mw28 WEBrick RCE Vulnerability

HIGH Published 2022-05-14 Modified 2023-07-27 Official page ↗
Aliases
CVE-2017-10784
Ecosystem
RubyGems
Packages
webrick
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2023-07-26

Affected packages

• RubyGems webrick: < 1.4.0 → fixed in 1.4.0

Description

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.

Related

Alias · CVE (1)

  • CVE-2017-10784 The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References