CVE-2019-5420: debian debian_linux
Vulnerability summary
CVE-2019-5420 is a critical (CVSS 9.8) vulnerability in debian debian_linux. EPSS estimates a 89.33% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 3 public exploits are recorded.
Weaponized exploit (exploit-database, 02-05-2019)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 27-03-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
CVSS metrics
4 scores · 3 sources · 3 versions- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
89.33%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
No change 0.00 pp
From 89.33% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Ruby On Rails - DoubleTap Development Mode secret_key_base Remote Code Execution (Metasploit)
Maturity: weaponized
Ruby On Rails DoubleTap Development Mode secret_key_base Vulnerability
exploit/multi/http/rails_double_tap
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-77Improper Neutralization of Special Elements used in a CommandThe product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
- CWE-330Use of Insufficiently Random ValuesThe product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- rails< 2:5.2.2.1+dfsg-1
- debian_linuxEOL8.0
Fedoraproject1 product
- fedoraEOL30
Rails1 product
- https://github.com/rails/rails5.2.2.1 | 6.0.0.beta3
RubyGems1 product
- railties≥ 5.2.0, < 5.2.2.1
Rubyonrails1 product
- railsEOL< 5.2.2.1 | 6.0.0:beta1 | 6.0.0:beta2
5 vendors · 6 products
References
12 links- weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/X Refsource CONFIRMPatchVendor Advisory
- groups.google.com/forum/X Refsource CONFIRM
