Description

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.

Remediation

References

CVE-2019-8323

Related Vulnerabilities

WordPress Plugin Buddypress Component Stats Local File Inclusion (1.0)

Drupal Core 8.x Security Bypass (8.0.0 - 8.5.5)

WordPress Plugin NewStatPress Multiple Vulnerabilities (1.0.4)

Zenphoto Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-6925)

WordPress Plugin Insert Pages Multiple Vulnerabilities (3.6.1)

Severity

High

Classification

CVE-2019-8323 CWE-138 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities