by Kastro
Paper/Archive/CVE-2022-30123

CVE-2022-30123

hackerone — A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lin…

EPSS 2%CVSS 10.0
critical.is priorityof 100
46
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 80.3.803 × 2016.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.

Affected

ProductAffectedFixed inSource
https://github.com/rack/rack2.0.9.1, 2.1.4.1, 2.2.3.1–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

refdiscuss.rubyonrails.org/t/cve-2022-30123-possible-shell-escape-sequence-injection-vulnerability-in-rack/80728advisorydebian.org/security/2023/dsa-5530advisorysecurity.gentoo.org/glsa/202310-18refsecurity.netapp.com/advisory/ntap-20231208-0011