PT-2019-13583 · Ruby · Simple Captcha2

Publicado 2019-07-26 · Atualizado 2019-09-03 · CVE-2019-14282

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions simple captcha2 gem version 0.2.3

Description The issue concerns a code-execution backdoor that was inserted by a third party into the simple captcha2 gem for Ruby. This backdoor allows for code execution.

Recommendations For simple captcha2 gem version 0.2.3, consider removing or replacing the gem to prevent potential code execution by the backdoor. As a temporary workaround, restrict access to any applications using this gem until a secure version is available.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2019-14282

GHSA-WG6J-R28M-7293

SNYK-RUBY-SIMPLECAPTCHA2-455501

Produtos afetados

Simple Captcha2

Referências · 9

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/simple_captcha2/CVE-2019-14282.yml · Exploit
• https://github.com/rubygems/rubygems.org/issues/2073 · Nota
• https://github.com/pludoni/simple-captcha · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-14282 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-14282 · Aviso do Fabricante
• https://snyk.io/vuln/SNYK-RUBY-SIMPLECAPTCHA2-455501 · Nota
• https://rubygems.org/gems/simple_captcha2/versions · Nota
• https://security.snyk.io/vuln/SNYK-RUBY-SIMPLECAPTCHA2-455501 · Nota
• https://osv.dev/vulnerability/GHSA-wg6j-r28m-7293 · Aviso do Fabricante