UpHeron
All vulnerabilities

Servers and applications

CVE-2017-10784

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.

Severity
High 8.8
Published
19 Sept 2017
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
RubyServers and applications · cpe:a:ruby-lang:ruby
  • Version 2.4.1
  • Version 2.4.0
  • Version 2.4.0-rc1
  • Version 2.4.0-preview3
All 14 release lines
  • Every version up to 2.2.7
  • Version 2.3.0-preview1
  • Version 2.3.0-preview2
  • Version 2.3.0
  • Version 2.3.1
  • Version 2.3.2
  • Version 2.3.3
  • Version 2.3.4
  • Version 2.4.0-preview1
  • Version 2.4.0-preview2
  • Version 2.4.0-preview3
  • Version 2.4.0-rc1
  • Version 2.4.0
  • Version 2.4.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-10784
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-10784