Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2017-10784

Good to know:

icon

Date: September 19, 2017

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.

Language: Ruby

Severity Score

Related Resources (31)

https://github.com/ruby/webrick/commit/4ac0f3843ab82d1c31e1cfc719409208adef7813
https://usn.ubuntu.com/3528-1
https://web.archive.org/web/20210621131814/http://www.securityfocus.com/bid/100853
https://github.com/ruby/webrick
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
https://access.redhat.com/errata/RHSA-2017:3485
https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released
https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/
https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released
https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/
http://www.securityfocus.com/bid/100853
https://access.redhat.com/security/cve/CVE-2017-10784
https://access.redhat.com/errata/RHSA-2018:0585
http://www.securitytracker.com/id/1042004
http://www.securitytracker.com/id/1039363
https://www.debian.org/security/2017/dsa-4031
https://access.redhat.com/errata/RHSA-2018:0583
https://web.archive.org/web/20211025092552/http://www.securitytracker.com/id/1039363
https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/
https://usn.ubuntu.com/3528-1/
https://usn.ubuntu.com/3685-1/
https://web.archive.org/web/20210919031115/http://www.securitytracker.com/id/1042004
https://hackerone.com/reports/223363
https://usn.ubuntu.com/3685-1
https://github.com/ruby/ruby/commit/6617c41292
https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2017-10784.yml
https://nvd.nist.gov/vuln/detail/CVE-2017-10784
https://security.gentoo.org/glsa/201710-18
https://access.redhat.com/errata/RHSA-2018:0378
https://www.mend.io/vulnerability-database/CVE-2017-10784

Severity Score

Weakness Type (CWE)

Authentication Issues

CWE-287

Top Fix

icon

Upgrade Version

Upgrade to version webrick - 1.4.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): COMPLETE
Integrity (I): COMPLETE
Availability (A): COMPLETE
Additional information:

Do you need more information?

Contact Us