Approved changes feed: RSS · Atom
cpe:2.3:a:mechanize_project:mechanize:*:*:*:*:*:ruby:*:*part: a version: * update: *
| Vendor | Mechanize Project (8b83e322-b3f4-5faf-b0f1-4464a87ecd43) |
|---|---|
| Product | Mechanize (bfdbb2d9-a735-5b80-9e27-e11c5cdcfe7b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | ruby |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-31033 |
vulnerable | 2026-06-08 05:43:40.024831 |
Authorization header leak in rubygem Mechanize
MEDIUM (5.9)
The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or later. There are no known workarounds for this issue.
Published: 2022-06-09T20:00:16.000Z
Updated: 2025-04-23T18:17:26.066Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21289 |
vulnerable | 2026-06-08 05:29:11.519690 |
Command Injection Vulnerability in Mechanize
HIGH (7.4)
Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.
Published: 2021-02-02T18:50:13.000Z
Updated: 2024-08-03T18:09:15.157Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.