[Forgot Password]
Login  Register Subscribe

23631

 
 

115038

 
 

96078

 
 

909

 
 

78009

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2015-9096

Date: (C)2017-06-14   (M)2017-10-04
 
CVSS Score: 4.3Access Vector: NETWORK
Exploitability Subscore: 8.6Access Complexity: MEDIUM
Impact Subscore: 2.9Authentication: NONE
 Confidentiality: NONE
 Integrity: PARTIAL
 Availability: NONE











Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.

Reference:
http://www.mbsd.jp/Whitepaper/smtpi.pdf
https://github.com/ruby/ruby/commit/0827a7e52ba3d957a634b063bf5a391239b9ffee
https://github.com/rubysec/ruby-advisory-db/issues/215
https://hackerone.com/reports/137631

CWE    1
CWE-93
OVAL    5
oval:org.secpod.oval:def:41491
oval:org.secpod.oval:def:113084
oval:org.secpod.oval:def:703718
oval:org.secpod.oval:def:1600779
...

© 2013 SecPod Technologies