GitHub Advisory DatabaseGHSA-F93J-HMCR-JCWHMoped Rubygem Data Injection Vulnerability
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.01 Low
EPSS
Percentile
83.6%
The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.
References
lists.fedoraproject.org/pipermail/package-announce/2015-July/161964.html
lists.fedoraproject.org/pipermail/package-announce/2015-July/161987.html
sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html
www.openwall.com/lists/oss-security/2015/06/06/3
bugzilla.redhat.com/show_bug.cgi?id=1229757
github.com/advisories/GHSA-f93j-hmcr-jcwh
github.com/mongoid/moped/commit/dd5a7c14b5d2e466f7875d079af71ad19774609b#diff-3b93602f64c2fe46d38efd9f73ef5358R24
github.com/rubysec/ruby-advisory-db/blob/master/gems/moped/CVE-2015-4410.yml
homakov.blogspot.ru/2012/05/saferweb-injects-in-various-ruby.html
nvd.nist.gov/vuln/detail/CVE-2015-4410
sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html
seclists.org/oss-sec/2015/q2/653
web.archive.org/web/20200228085849/www.securityfocus.com/bid/75045
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.01 Low
EPSS
Percentile
83.6%