Information Disclosure Vulnerability in Ruby's FTP Component
CVE-2021-31810

5.8MEDIUM

Key Information:

Vendor

Ruby-lang

Status
Ruby
Vendor
CVE Published:
13 July 2021

What is CVE-2021-31810?

A flaw exists in Ruby's handling of the PASV response in its FTP component, affecting versions up to 3.0.1. An attacker operating a malicious FTP server can exploit this vulnerability to manipulate Net::FTP into making unauthorized connections to specified IP addresses and ports. This behavior can expose sensitive information about private services through unauthorized port scans and service banner extractions, ultimately leading to further exploitation.

References

https://hackerone.com/reports/1145454
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg0...
mailing-list

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.