« Volver al listado

CVE-2024-41123

Estado: ModificadaAlta (7.5)—

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ruby-lang — Rexml

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-41123",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-41123",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-01T14:33:21.621506Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "ruby",
          "product": "rexml",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.3.3"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*"
          ],
          "vendor": "ruby-lang",
          "product": "rexml",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.3.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-01T15:15:13.213",
  "references": [
    {
      "url": "https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8",
      "tags": [
        "Not Applicable"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh",
      "tags": [
        "Not Applicable"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20241227-0005/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities."
    },
    {
      "lang": "es",
      "value": "REXML es un conjunto de herramientas XML para Ruby. La gema REXML anterior a 3.3.2 tiene algunas vulnerabilidades DoS cuando analiza un XML que tiene muchos caracteres específicos, como espacios en blanco, `&gt;]` y `]&gt;`. La gema REXML 3.3.3 o posterior incluye los parches para corregir estas vulnerabilidades."
    }
  ],
  "lastModified": "2026-06-17T07:47:19.347",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EBF24ACB-780A-4611-B978-F93033207F85",
              "versionEndExcluding": "3.2.7"
            },
            {
              "criteria": "cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35894CC8-FEFA-4F30-A9FF-4582B7DF108C",
              "versionEndExcluding": "3.3.2",
              "versionStartIncluding": "3.2.8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}