CVE-2015-9096

Advisory lineage Upstream: 0 Downstream: 9
Modified
Published: 12 Jun 2017, 20:00
Last modified:06 Aug 2024, 08:36

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
6.1 MEDIUM
v3.0 (nvd)
EPSS Score
1.59% LOW
2% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

12 Jun 2017, 20:00
Published
Vulnerability first disclosed
06 Aug 2024, 08:36
Last Modified
Vulnerability information updated

Description

Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.

CVSS Metrics

  • v3.0•MEDIUM•Score: 6.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 1.59%• Percentile: 82%

Techniques & Countermeasures

  • CWE-93•Improper Neutralization of CRLF Sequences ('CRLF Injection')

    The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Affected Systems

  • ruby-lang•ruby

    ≤ 2.4.0

References (6)