CVE-2017-0903 Vulnerability Details

  /     /     /  

CVE-2017-0903 Metadata Quick Info

CVE Published: 11/10/2017 | CVE Updated: 17/09/2024 | CVE Year: 2017
Source: hackerone | Vendor: HackerOne | Product: RubyGems
Status : PUBLISHED

---

CVE-2017-0903 Description

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-502
CWE Name: Deserialization of Untrusted Data (CWE-502)
Source: HackerOne

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).