7.5

CVE-2021-41819

Exploit

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

Data is provided by the National Vulnerability Database (NVD)
Ruby-lang ≫ Cgi Version0.1.0 SwPlatformruby
Ruby-lang ≫ Cgi Version0.2.0 SwPlatformruby
Ruby-lang ≫ Cgi Version0.3.0 SwPlatformruby
Ruby-lang ≫ Ruby Version <= 2.6.8
Ruby-lang ≫ Ruby Version >= 2.7.0 < 2.7.5
Ruby-lang ≫ Ruby Version >= 3.0.0 < 3.0.3
Redhat ≫ Enterprise Linux Version8.0
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Debian ≫ Debian Linux Version11.0
Suse ≫ Linux Enterprise Version11.0 Updatesp1
Suse ≫ Linux Enterprise Version12.0
Suse ≫ Linux Enterprise Version15.0
Opensuse ≫ Factory Version-
Opensuse ≫ Leap Version15.2
Fedoraproject ≫ Fedora Version34
Fedoraproject ≫ Fedora Version35
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.88% 0.746
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-565 Reliance on Cookies without Validation and Integrity Checking

The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

https://hackerone.com/reports/910552
Third Party Advisory
Permissions Required