// For flags

CVE-2022-30122

rubygem-rack: crafted multipart POST request may cause a DoS

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.

Existe una posible vulnerabilidad de Denegación de Servicio (DoS) en Rack &lt;2.0.9.1, &lt;2.1.4.1 y &lt;2.2.3.1 en el componente de análisis multiparte de Rack.

A denial of service flaw was found in ruby-rack. An attacker crafting multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a denial of service.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2022-05-02 CVE Reserved
  • 2022-10-31 CVE Published
  • 2024-07-26 EPSS Updated
  • 2024-11-19 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-400: Uncontrolled Resource Consumption
  • CWE-770: Allocation of Resources Without Limits or Throttling
  • CWE-1333: Inefficient Regular Expression Complexity
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Rack Project
Search vendor "Rack Project"
Rack
Search vendor "Rack Project" for product "Rack"
>= 1.2 < 2.0.9.1
Search vendor "Rack Project" for product "Rack" and version " >= 1.2 < 2.0.9.1"
-
Affected
Rack Project
Search vendor "Rack Project"
Rack
Search vendor "Rack Project" for product "Rack"
>= 2.1.0 < 2.1.4.1
Search vendor "Rack Project" for product "Rack" and version " >= 2.1.0 < 2.1.4.1"
-
Affected
Rack Project
Search vendor "Rack Project"
Rack
Search vendor "Rack Project" for product "Rack"
>= 2.2.0 < 2.2.3.1
Search vendor "Rack Project" for product "Rack" and version " >= 2.2.0 < 2.2.3.1"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
11.0
Search vendor "Debian" for product "Debian Linux" and version "11.0"
-
Affected