Remote Code Execution Affecting railties package, versions >=5.2.2, <5.2.2.1
Threat Intelligence
Exploit Maturity
Mature
EPSS
95.98% (100th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-RAILTIES-173785
- published 13 Mar 2019
- disclosed 13 Mar 2019
- credit ooooooo_q
Introduced: 13 Mar 2019
CVE-2019-5420 Open this link in a new tabHow to fix?
Upgrade railties to version 5.2.2.1 or higher.
Overview
railties is an application bootup, plugins, generators, and rake tasks.
Affected versions of this package are vulnerable to Remote Code Execution. An attacker could guess the automatically generated development mode secret token. This secret token could be used in combination with other Rails internals to escalate to a remote code execution exploit.
CVSS Scores
version 3.1