CVE-2021-3779

MEDIUM

ruby-mysql <2.10.0 - Info Disclosure

Title source: llm

Description

A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later.

References (1)

[Exploit, Mitigation, Third Party Advisory] https://www.rapid7.com/blog/post/2022/06/28/cve-2021-3779-ruby-mysql-gem-client-file-read-fixed/

Scores

CVSS v3 6.5

EPSS 0.0039

EPSS Percentile 60.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE

CWE-610

Status published

Products (2)

ruby-mysql_project/ruby-mysql < 2.10.0

rubygems/ruby-mysql 0 - 2.10.0RubyGems

Published Jun 28, 2022

Tracked Since Feb 18, 2026