Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-31810

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).

Published

2021-07-13T13:15:09.243

Last Modified

2024-11-21T06:06:16.320

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.8 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application ruby-lang ruby ≤ 2.6.7 Yes
Application ruby-lang ruby ≤ 2.7.3 Yes
Application ruby-lang ruby ≤ 3.0.1 Yes
Operating System fedoraproject fedora 34 No
Operating System debian debian_linux 9.0 Yes
Application oracle jd_edwards_enterpriseone_tools < 9.2.6.1 Yes
References