Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2021-21289

Published: 2 February 2021

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.

Priority

Medium

Cvss 3 Severity Score

8.3

Score breakdown

Status

Package Release Status
ruby-mechanize
Launchpad, Ubuntu, Debian
upstream
Released (2.7.7-1)
trusty Does not exist

bionic Needs triage

focal Needs triage

groovy Ignored
(end of life)
hirsute Ignored
(end of life)
xenial Needs triage

kinetic Ignored
(end of life, was needs-triage)
jammy Needs triage

impish Ignored
(end of life)
lunar Not vulnerable
(2.7.7-3)

Severity score breakdown

Parameter Value
Base score 8.3
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Scope Changed
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H