Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2017-10784

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.

  • Published: Sep 19, 2017
  • Updated: Apr 13, 2023
  • CVE: CVE-2017-10784
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 8.8
  • AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: High
  • Score: 9.3
  • AV:N/AC:M/Au:N/C:C/I:C/A:C

CWEs:

OWASP TOP 10:

Software From Fixed in
ruby-lang / ruby 2.3.4 2.3.4.x
ruby-lang / ruby 2.4.1 2.4.1.x
ruby-lang / ruby 2.4.0-preview1 2.4.0-preview1.x
ruby-lang / ruby 2.3.0-preview1 2.3.0-preview1.x
ruby-lang / ruby 2.3.2 2.3.2.x
ruby-lang / ruby - 2.2.7.x
ruby-lang / ruby 2.3.1 2.3.1.x
ruby-lang / ruby 2.3.3 2.3.3.x
ruby-lang / ruby 2.3.0-preview2 2.3.0-preview2.x
ruby-lang / ruby 2.3.0 2.3.0.x
ruby-lang / ruby 2.4.0-preview3 2.4.0-preview3.x
ruby-lang / ruby 2.4.0-preview2 2.4.0-preview2.x
ruby-lang / ruby 2.4.0 2.4.0.x
ruby-lang / ruby 2.4.0-rc1 2.4.0-rc1.x