CVE-2019-10842: Code Injection
Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticated attacker can craft the cfduid cookie value with base64 arbitrary code to be executed via eval(), which can be leveraged to execute arbitrary code on the target system. Note that there are three underscore characters in the cookie name. This is unrelated to the cfduid cookie that is legitimately used by Cloudflare.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10842?
CVE-2019-10842 is a vulnerability that allows an attacker to execute arbitrary code on the target system.
How severe is CVE-2019-10842?
CVE-2019-10842 has a severity rating of critical with a CVSS score of 9.8.
Which software is affected by CVE-2019-10842?
The software affected by CVE-2019-10842 is bootstrap-sass version 3.2.0.3 downloaded from rubygems.org.
How can the vulnerability in bootstrap-sass 3.2.0.3 be fixed?
To fix the vulnerability in bootstrap-sass 3.2.0.3, upgrade to version 3.2.0.4.
Where can I find more information about CVE-2019-10842?
You can find more information about CVE-2019-10842 at the following references: [link1], [link2], [link3].