CVE-2019-13354 describes a critical code-execution backdoor found in version 0.0.7 of the strong_password Ruby gem, which was distributed via RubyGems.org. This vulnerability carries a CVSS score of 9.8 (CRITICAL) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While the vulnerability is not listed in CISA's KEV catalog, there is no public exploit code available in Metasploit, Nuclei, or ExploitDB. However, it has garnered some community discussion and media coverage, indicating awareness of the issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.0.7CPE matchmatch criteria | cpe:2.3:a:strong_password_project:strong_password:0.0.7:*:*:*:*:ruby:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.