CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
97.5%
Arbitrary code execution (via backdoor code, when
downloaded from rubygems.org) was discovered in
bootstrap-sass 3.2.0.3.
Users are advised to upgrade immediately to 3.2.0.4
An unauthenticated attacker can craft the ___cfduid cookie value
with base64 arbitrary code to be executed via eval(), which can
be leveraged to execute arbitrary code on the target system.
(Note that there are three underscore characters in the cookie name.
This is unrelated to the __cfduid cookie that is legitimately used by
Cloudflare.)
Vendor | Product | Version | CPE |
---|---|---|---|
ruby | bootstrap-sass | * | cpe:2.3:a:ruby:bootstrap-sass:*:*:*:*:*:*:*:* |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
97.5%