Lucene search

K
redosRedosROS-20240827-06
HistoryAug 27, 2024 - 12:00 a.m.

ROS-20240827-06

2024-08-2700:00:00
redos.red-soft.ru
2
ruby interpreter
active storage
vulnerability
cross-site scripting
sensitive information
input data
web page
set-cookie header
user session cookie
local attacker
large binary objects

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

Low

The vulnerability in the Ruby interpreter is related to improper neutralization of input data during the generation of a
of a web page. Exploitation of the vulnerability could allow an attacker acting locally to conduct
cross-site scripting

Vulnerability in the Active Storage component of the Ruby interpreter is related to sending the Set-Cookie header
along with a user session cookie when serving large binary objects. Exploitation of the vulnerability
could allow an attacker acting locally to obtain sensitive information

OSVersionArchitecturePackageVersionFilename
redos7.3x86_64ruby< 2.7.6-131UNKNOWN

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

Low