CVE-2021-41819 describes a vulnerability in CGI::Cookie.parse in Ruby (through 2.6.8) and the CGI gem (through 0.3.0), where security prefixes in cookie names are mishandled, affecting various Linux distributions and Ruby itself. This high-severity vulnerability (CVSS 7.5) can be exploited remotely with low complexity and no user interaction, leading to high integrity impacts. Despite its severity, there is no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.1.0CPE matchmatch criteria | cpe:2.3:a:ruby-lang:cgi:0.1.0:*:*:*:*:ruby:*:* | ||
0.2.0CPE matchmatch criteria | cpe:2.3:a:ruby-lang:cgi:0.2.0:*:*:*:*:ruby:*:* | ||
0.3.0CPE matchmatch criteria | cpe:2.3:a:ruby-lang:cgi:0.3.0:*:*:*:*:ruby:*:* | ||
<= 2.6.8CPE matchmatch criteria | cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* | ||
>= 2.7.0, < 2.7.5CPE matchmatch criteria | cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Cookie Prefix Spoofing in CGI::Cookie.parse
Jan 21, 2022CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
Jan 11, 2022ruby: Cookie prefix spoofing in CGI::Cookie.parse
Nov 24, 2021