CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
97.5%
Arbitrary code execution (via backdoor code) was discovered in
bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An
unauthenticated attacker can craft the ___cfduid cookie value with base64
arbitrary code to be executed via eval(), which can be leveraged to execute
arbitrary code on the target system. Note that there are three underscore
characters in the cookie name. This is unrelated to the __cfduid cookie
that is legitimately used by Cloudflare.
Author | Note |
---|---|
msalvatore | v3.2.0.3 was removed from the RubyGEms registry and replaced with a malicious version on March 26th, 2019. The malicious version was removed 1 hour after it was uploaded. None of the bootstrap packages in Ubuntu are affected. |
github.com/twbs/bootstrap-sass/issues/1195
launchpad.net/bugs/cve/CVE-2019-10842
nvd.nist.gov/vuln/detail/CVE-2019-10842
security-tracker.debian.org/tracker/CVE-2019-10842
snyk.io/blog/malicious-remote-code-execution-backdoor-discovered-in-the-popular-bootstrap-sass-ruby-gem/
snyk.io/vuln/SNYK-RUBY-BOOTSTRAPSASS-174093
www.cve.org/CVERecord?id=CVE-2019-10842
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
97.5%