Code injection in Narou · CVE-2021-35514 · GitHub Advisory Database · GitHub

Code injection in Narou

High severity GitHub Reviewed Published Jul 2, 2021 to the GitHub Advisory Database • Updated Jan 24, 2023

Package

narou (RubyGems)

Affected versions

< 3.8.0

Patched versions

3.8.0

Description

Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.

References

Published by the National Vulnerability Database

Jun 28, 2021

Reviewed Jun 30, 2021

Published to the GitHub Advisory Database Jul 2, 2021

Last updated Jan 24, 2023

Severity

High

8.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N