Remote Code Execution (RCE)

2019-07-1601:56:03

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.008 Low

EPSS

Percentile

81.2%

JSON

slanger is vulnerable to remote code execution (RCE). An unsafe deserialization of Ruby objects allows remote attackers to execute arbitrary code using a malicious JSON containing arbitrary object of various classes.

CPENameOperatorVersion
slangerle0.6.0

CPE	Name	Operator	Version
	slanger	le	0.6.0

References

github.com/stevegraham/slanger/pull/238

honoki.net/2019/03/18/rce-in-slanger-0-6-0/

portswigger.net/daily-swig/push-to-patch-slanger

0.008 Low

EPSS

Percentile

81.2%

JSON

Related for VERACODE:20827