Description

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

Remediation

References

CVE-2021-33621

Related Vulnerabilities

Coppermine Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2008-3481)

WordPress Plugin Jetpack-WP Security, Backup, Speed, & Growth Cross-Site Scripting (6.4.2)

PostgreSQL Generation of Error Message Containing Sensitive Information Vulnerability (CVE-2014-8161)

WordPress Plugin Flip Book 'php.php' Arbitrary File Upload (1.0)

Undertow Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2017-7559)

Severity

High

Classification

CVE-2021-33621 CWE-436 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities