CVE-2024-27281 — Deserialization of Untrusted Data in Rdoc
CWE-502 — Deserialization of Untrusted DataCWE-74 — InjectionCWE-94 — Code Injection13 documents9 sources
Severity
4.5MEDIUMNVD
EPSS
2.5%
top 14.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 14
Latest updateFeb 10
Description
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. (When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.) The main fixed version is 6.6.3.1. For Ruby 3.0 us…
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:LExploitability: 1.0 | Impact: 3.4
Affected Packages1 packages
🔴Vulnerability Details
6📋Vendor Advisories
5Microsoft▶
An issue was discovered in RDoc 6.3.3 through 6.6.2 as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file object injection and resultant ↗2024-05-14
Debian▶
CVE-2024-27281: ruby2.7 - An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x ...↗2024