The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that t

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• ruby-lang ruby1.8.5
• ruby-lang ruby1.8.6

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-17405Ruby before 2.4.3 allows Net::FTP command injection.
  57Plan
• CVE-2008-3656Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick i
  52Plan
• CVE-2021-28966In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
  47Plan
• CVE-2017-14064Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call.
  42Plan
• CVE-2017-17790The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demons
  41Plan
• CVE-2016-2339An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby.
  41Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Authentication is added route by route instead of being enforced in one place. When a route added later bypasses the shared middleware, the session check never runs for it.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use("/admin", requireSession, adminRouter);2
3// Route added later skips the middleware4app.post("/admin-api/config", updateConfig);

1const admin = express.Router();2admin.use(requireSession, requireRole("admin"));3
4admin.post("/config", updateConfig);5app.use("/admin", admin);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.