PT-2022-23161 · Unknown · Rubygems.Org

Segiddins · Published 2022-09-07 · Updated 2022-09-12 · CVE-2022-36073

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions RubyGems.org (affected versions not specified)

Description A bug in the password and email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. This could enable the attacker to save API keys for that account. When a legitimate user attempts to create an account with their email and has to reset the password to gain access, the attacker could then be able to publish and yank versions of those gems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-36073

GHSA-8QPF-WF2P-25VG

Affected Products

Rubygems.Org

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36073.json · Exploit
• https://github.com/rubygems/rubygems.org/security/advisories/GHSA-8qpf-wf2p-25vg · Patch
• https://github.com/rubygems/rubygems.org/commit/90c9e6aac2d91518b479c51d48275c57de492d4d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36073 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36073 · Vendor Advisory
• https://t.me/cibsecurity/49408 · Telegram Post