CVE-2021-21289 | Vulnetix

CVE-2021-21289 PUBLISHED CVSS 8.300000190734863 HIGH

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.

EPSS 3.51% · 89.1th percentile

Risk Scores

CVSS 3.1

8.300000190734863

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS Score

3.51%

89.1th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:20.04:LTS	ruby-mechanize	0, 2.7.6-1
Ubuntu:22.04:LTS	ruby-mechanize	2.7.7-1, 2.7.7-3, 0
Ubuntu:16.04:LTS	ruby-mechanize	0, 2.7.3-1
Ubuntu:18.04:LTS	ruby-mechanize	0, 2.7.5-1, 2.7.5-2

Timeline

Feb 2, 2021 CVE Published
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Oct 27, 2021 EPSS Score
Dec 28, 2021 EPSS Score
Feb 4, 2022 EPSS Score
Mar 1, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Jul 5, 2022 EPSS Score
Sep 7, 2022 EPSS Score
Nov 9, 2022 EPSS Score
Mar 7, 2023 EPSS Score

References

Open in Interactive Console →