Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2009-4492 Details

Description

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://secunia.com/advisories/37949	CVE	Not ApplicableVendor Advisory
http://securitytracker.com/id?1023429	CVE	Broken LinkExploitThird Party AdvisoryVDB Entry
http://www.redhat.com/support/errata/RHSA-2011-0908.html	CVE	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-0909.html	CVE	Third Party Advisory
http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection	CVE	PatchVendor Advisory
http://www.securityfocus.com/archive/1/508830/100/0/threaded	CVE	Broken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/37710	CVE	Broken LinkExploitThird Party AdvisoryVDB Entry
http://www.ush.it/team/ush/hack_httpd_escape/adv.txt	CVE	Broken LinkExploit
http://www.vupen.com/english/advisories/2010/0089	CVE	Permissions Required
http://secunia.com/advisories/37949	[email protected]	Not ApplicableVendor Advisory
http://securitytracker.com/id?1023429	[email protected]	Broken LinkExploitThird Party AdvisoryVDB Entry
http://www.redhat.com/support/errata/RHSA-2011-0908.html	[email protected]	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-0909.html	[email protected]	Third Party Advisory
http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection	[email protected]	PatchVendor Advisory
http://www.securityfocus.com/archive/1/508830/100/0/threaded	[email protected]	Broken LinkThird Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/37710	[email protected]	Broken LinkExploitThird Party AdvisoryVDB Entry
http://www.ush.it/team/ush/hack_httpd_escape/adv.txt	[email protected]	Broken LinkExploit
http://www.vupen.com/english/advisories/2010/0089	[email protected]	Permissions Required

see all 18 references

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-noinfo	Insufficient Information to Classify Weakness	[email protected]

Affected Products

Product	Versions
ruby-lang webrick	1.3.1
CPE cpe:2.3:a:ruby-lang:webrick:1.3.1:::::ruby:: Remediation No remediation found in references.
ruby-lang ruby	>= 1.8.6, <= 1.8.6.383 >= 1.8.7, <= 1.8.7.248 >= 1.9.1, <= 1.9.1.376
CPE cpe:2.3:a:ruby-lang:ruby:::::::: Remediation No remediation found in references.

Change History

7 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 23, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Aug 1, 2023	Modified Analysis	[email protected]
Oct 10, 2018	CVE Modified	[email protected]
Jan 14, 2010	Initial Analysis	[email protected]