WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ruby-tcltkUpgrade ruby-develUpgrade irbUpgrade ruby-irbUpgrade ruby-modeUpgrade rubyUpgrade ruby-libsUpgrade ruby-riUpgrade ruby-docsUpgrade ruby-rdoc | Dec 1, 2016 | Jan 13, 2010 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Jan 13, 2010 |
| Oracle_linux | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-rdocUpgrade ruby-modeUpgrade ruby-tcltkUpgrade ruby-develUpgrade ruby-riUpgrade ruby-docsUpgrade ruby-libs | Oct 16, 2024 | Jan 13, 2010 |
| Suse | — | Upgrade ruby-test-suiteUpgrade ruby-doc-riUpgrade ruby-tkUpgrade ruby-examplesUpgrade rubyUpgrade ruby-develUpgrade ruby-doc-html | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libruby1.9Upgrade ruby1.9 | Nov 8, 2024 | Jan 13, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub