Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-91b7-xx8t-rqhr
Vulnerability ID VCID-91b7-xx8t-rqhr
Aliases CVE-2017-10784
GHSA-369m-2gv6-mw28
Summary Improper Authentication The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
Status Published
Exploitability 0.5
Weighted Severity 8.4
Risk 4.2
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-287 Improper Authentication
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-117 Improper Output Neutralization for Logs
System Score Found at
cvssv3 8.8 https://access.redhat.com/errata/RHSA-2017:3485
cvssv3.1 8.8 https://access.redhat.com/errata/RHSA-2017:3485
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:3485
cvssv3.1 8.8 https://access.redhat.com/errata/RHSA-2018:0378
generic_textual HIGH https://access.redhat.com/errata/RHSA-2018:0378
cvssv3.1 8.8 https://access.redhat.com/errata/RHSA-2018:0583
generic_textual HIGH https://access.redhat.com/errata/RHSA-2018:0583
cvssv3.1 8.8 https://access.redhat.com/errata/RHSA-2018:0585
generic_textual HIGH https://access.redhat.com/errata/RHSA-2018:0585
cvssv3 5.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-10784.json
epss 0.01385 https://api.first.org/data/v1/epss?cve=CVE-2017-10784
epss 0.01385 https://api.first.org/data/v1/epss?cve=CVE-2017-10784
epss 0.01385 https://api.first.org/data/v1/epss?cve=CVE-2017-10784
epss 0.01385 https://api.first.org/data/v1/epss?cve=CVE-2017-10784
epss 0.01385 https://api.first.org/data/v1/epss?cve=CVE-2017-10784
epss 0.01385 https://api.first.org/data/v1/epss?cve=CVE-2017-10784
epss 0.01385 https://api.first.org/data/v1/epss?cve=CVE-2017-10784
epss 0.014 https://api.first.org/data/v1/epss?cve=CVE-2017-10784
epss 0.014 https://api.first.org/data/v1/epss?cve=CVE-2017-10784
epss 0.014 https://api.first.org/data/v1/epss?cve=CVE-2017-10784
cvssv2 6.4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 5.4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-369m-2gv6-mw28
cvssv3.1 8.8 https://github.com/ruby/ruby/commit/6617c41292
generic_textual HIGH https://github.com/ruby/ruby/commit/6617c41292
cvssv3.1 8.8 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2017-10784.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2017-10784.yml
cvssv3.1 8.8 https://github.com/ruby/webrick
generic_textual HIGH https://github.com/ruby/webrick
cvssv3.1 8.8 https://github.com/ruby/webrick/commit/4ac0f3843ab82d1c31e1cfc719409208adef7813
generic_textual HIGH https://github.com/ruby/webrick/commit/4ac0f3843ab82d1c31e1cfc719409208adef7813
cvssv3.1 8.8 https://hackerone.com/reports/223363
generic_textual HIGH https://hackerone.com/reports/223363
cvssv3.1 8.8 https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
cvssv2 9.3 https://nvd.nist.gov/vuln/detail/CVE-2017-10784
cvssv3 8.8 https://nvd.nist.gov/vuln/detail/CVE-2017-10784
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2017-10784
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2017-10784
cvssv3.1 8.8 https://security.gentoo.org/glsa/201710-18
generic_textual HIGH https://security.gentoo.org/glsa/201710-18
cvssv3.1 8.8 https://usn.ubuntu.com/3528-1
generic_textual HIGH https://usn.ubuntu.com/3528-1
cvssv3.1 8.8 https://usn.ubuntu.com/3685-1
generic_textual HIGH https://usn.ubuntu.com/3685-1
cvssv3.1 8.8 https://web.archive.org/web/20210621131814/http://www.securityfocus.com/bid/100853
generic_textual HIGH https://web.archive.org/web/20210621131814/http://www.securityfocus.com/bid/100853
cvssv3.1 8.8 https://web.archive.org/web/20210919031115/http://www.securitytracker.com/id/1042004
generic_textual HIGH https://web.archive.org/web/20210919031115/http://www.securitytracker.com/id/1042004
cvssv3.1 8.8 https://web.archive.org/web/20211025092552/http://www.securitytracker.com/id/1039363
generic_textual HIGH https://web.archive.org/web/20211025092552/http://www.securitytracker.com/id/1039363
cvssv3.1 8.8 https://www.debian.org/security/2017/dsa-4031
generic_textual HIGH https://www.debian.org/security/2017/dsa-4031
cvssv3.1 8.8 https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released
generic_textual HIGH https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released
cvssv3.1 8.8 https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released
generic_textual HIGH https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released
cvssv3.1 8.8 https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784
generic_textual HIGH https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2017:3485
https://access.redhat.com/errata/RHSA-2018:0378
https://access.redhat.com/errata/RHSA-2018:0583
https://access.redhat.com/errata/RHSA-2018:0585
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-10784.json
https://api.first.org/data/v1/epss?cve=CVE-2017-10784
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0898
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0903
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10784
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14033
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/ruby/ruby/commit/6617c41292
https://github.com/ruby/webrick
https://github.com/ruby/webrick/commit/4ac0f3843ab82d1c31e1cfc719409208adef7813
https://hackerone.com/reports/223363
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
https://security.gentoo.org/glsa/201710-18
https://usn.ubuntu.com/3528-1
https://usn.ubuntu.com/3528-1/
https://usn.ubuntu.com/3685-1
https://usn.ubuntu.com/3685-1/
https://web.archive.org/web/20210621131814/http://www.securityfocus.com/bid/100853
https://web.archive.org/web/20210919031115/http://www.securitytracker.com/id/1042004
https://web.archive.org/web/20211025092552/http://www.securitytracker.com/id/1039363
https://www.debian.org/security/2017/dsa-4031
https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released
https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/
https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released
https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/
https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784
https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/
http://www.securityfocus.com/bid/100853
http://www.securitytracker.com/id/1039363
http://www.securitytracker.com/id/1042004
1492012 https://bugzilla.redhat.com/show_bug.cgi?id=1492012
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:2.3.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:2.3.0:preview1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.0:preview1:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:2.3.0:preview2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.0:preview2:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:2.3.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.1:*:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:2.3.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.2:*:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:2.3.3:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.3:*:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:2.3.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.3.4:*:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:2.4.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:2.4.0:preview1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:preview1:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:2.4.0:preview2:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:preview2:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:2.4.0:preview3:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:preview3:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:2.4.0:rc1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.0:rc1:*:*:*:*:*:*
cpe:2.3:a:ruby-lang:ruby:2.4.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:ruby:2.4.1:*:*:*:*:*:*:*
CVE-2017-10784 https://nvd.nist.gov/vuln/detail/CVE-2017-10784
CVE-2017-10784.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2017-10784.yml
GHSA-369m-2gv6-mw28 https://github.com/advisories/GHSA-369m-2gv6-mw28
USN-3439-1 https://usn.ubuntu.com/3439-1/
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:3485
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2018:0378
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2018:0583
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2018:0585
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-10784.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/ruby/ruby/commit/6617c41292
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2017-10784.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/ruby/webrick
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/ruby/webrick/commit/4ac0f3843ab82d1c31e1cfc719409208adef7813
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://hackerone.com/reports/223363
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2017-10784
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-10784
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-10784
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/201710-18
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://usn.ubuntu.com/3528-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://usn.ubuntu.com/3685-1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://web.archive.org/web/20210621131814/http://www.securityfocus.com/bid/100853
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://web.archive.org/web/20210919031115/http://www.securitytracker.com/id/1042004
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://web.archive.org/web/20211025092552/http://www.securitytracker.com/id/1039363
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2017/dsa-4031
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.80265
EPSS Score 0.01385
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:50:29.357113+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/webrick/CVE-2017-10784.yml 38.0.0