Remote Code Execution Vulnerability in ActiveSupport Ruby Gem from Ruby
CVE-2018-3779

9.8CRITICAL

Key Information:

Vendor

Hackerone

Status
Active-support Ruby Gem
Vendor
CVE Published:
10 August 2018

What is CVE-2018-3779?

A remote code execution vulnerability exists in the ActiveSupport Ruby gem version 5.2.0. This issue arises from a backdoor that allows attackers to execute arbitrary code on systems using the affected gem. Attackers can leverage this flaw to compromise system security and gain unauthorized access, potentially leading to severe consequences for affected applications. It is crucial for developers to update to a secure version of the gem to mitigate this risk.

Affected Version(s)

active-support ruby gem 5.2.0

References

https://hackerone.com/reports/392311
x_refsource_MISC

EPSS Score

8% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.