CVE-2022-23634 describes an information leakage vulnerability affecting Puma web server versions prior to 5.6.2 and Ruby on Rails versions prior to 7.0.2.2. The issue arises when Puma fails to close response bodies, which, in conjunction with Rails' `CurrentAttributes` implementation, can lead to sensitive data exposure. This vulnerability carries a CVSS score of 5.9 (Medium) due to its network-based attack vector and high confidentiality impact, though it requires high attack complexity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.3.11CPE matchmatch criteria | cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:* | ||
>= 5.0.0, < 5.6.2CPE matchmatch criteria | cpe:2.3:a:puma:puma:*:*:*:*:*:ruby:*:* | ||
>= 5.0.0, < 5.2.6.2CPE matchmatch criteria | cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* | ||
>= 6.0.0, < 6.0.4.6CPE matchmatch criteria | cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* | ||
>= 6.1.0, < 6.1.4.6CPE matchmatch criteria | cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.