CVE-2017-10784
high-risk
Published 2017-09-19
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
Do I need to act?
~
1.4% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10
High
NETWORK
/ LOW complexity
Affected Vendors
References (30)
Third Party Advisory
http://www.securityfocus.com/bid/100853
Third Party Advisory
http://www.securitytracker.com/id/1039363
Third Party Advisory
http://www.securityfocus.com/bid/100853
Third Party Advisory
http://www.securitytracker.com/id/1039363
and 10 more references
52
/ 100
high-risk
Severity
30/34 · Critical
Exploitability
4/34 · Minimal
Exposure
18/34 · Moderate