CVE-2017-10784

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 16.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-09-19 · updated 2026-06-17
Weakness: CWE-287

Description

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.

Affected products

Ruby: through 2.2.7; 2.3.0, 2.3.0-preview1, 2.3.0-preview2, 2.3.1, 2.3.2, 2.3.3 (+7)

References

http://www.securityfocus.com/bid/100853
http://www.securitytracker.com/id/1039363
http://www.securitytracker.com/id/1042004
https://access.redhat.com/errata/RHSA-2017:3485
https://access.redhat.com/errata/RHSA-2018:0378
https://access.redhat.com/errata/RHSA-2018:0583
https://access.redhat.com/errata/RHSA-2018:0585
https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
https://security.gentoo.org/glsa/201710-18
https://usn.ubuntu.com/3528-1/
https://usn.ubuntu.com/3685-1/
https://www.debian.org/security/2017/dsa-4031

Get alerted when CVE-2017-10784 or the next vulnerability affects your stack