GHSA-M42H-MH85-4QGC Use of Insufficiently Random Values in Railties Allows Remote Code Execution

🗓️ 13 Mar 2019 17:28:35Reported by GoogleType

osv🔗 osv.dev👁 43 Views

Use of Insufficiently Random Values in Railties Allows Remote Code Execution. Possible Remote Code Execution Exploit in Rails Development Mode. Upgrade or apply workaround immediately

Reporter	Title	Published	Views	Family All 86
0day.today	Ruby On Rails DoubleTap Development Mode secret_key_base Remote Code Execution Exploit	2 May 201900:00	–	zdt
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	6 Sep 202112:28	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	20 Jan 202115:06	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	6 Sep 202112:28	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	21 Mar 201915:42	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	11 May 202111:32	–	githubexploit
GithubExploit	Exploit for Path Traversal in Rubyonrails Rails	23 Mar 201902:52	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	2 Jul 202215:44	–	githubexploit
ATTACKERKB	Ruby on Rails DoubleTap Development Mode secret_key_base Vulnerability	27 Mar 201900:00	–	attackerkb
BDU FSTEC	The vulnerability of the Ruby on Rails software platform, related to errors in the code for generating pseudo-random numbers, allows attackers to execute arbitrary code.	27 Mar 201900:00	–	bdu_fstec

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-5420
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/railties/CVE-2019-5420.yml
groups	www.groups.google.com/forum/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA
weblog	www.weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released
exploit-db	www.exploit-db.com/exploits/46785
packetstormsecurity	www.packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.html

22 Feb 2024 05:42Current

9.9High risk

Vulners AI Score9.9

CVSS 39.8

EPSS0.92144