CVE-2021-33621
highpriority · track · 36EPSS 0.025 · 84 %ileDEEURUUSEPSS · scored 2026-10-27
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (48)
Products and version ranges known to be affected.
- Xerox FreeFlow Print Server v7 for Solarisall versionscert_bundDEcpe:/a:xerox:freeflow_print_server:v7_for_solaris
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2022-2173Ruby: Schwachstelle ermöglicht Manipulation von DateienDeutsch2022-11-24csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ruby ausnutzen, um Dateien zu manipulieren.
- WID-SEC-W-2023-2031Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2023-08-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
- GHSA-vc47-6rqg-c7f5HTTP response splitting in CGI2022-11-19ghsa · osvUS
Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.
- BIT-ruby-2021-336212024-03-06vendor · osvUS
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
- BIT-ruby-min-2021-336212025-01-27vendor · osvUS
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
also known as (7)
Other names and identifiers for this entity.
- CNNVD-202211-3133cnnvd
- EUVD-2022-7435enisa_euvd
- BDU:2023-03834fstec_bdu
- GHSA-vc47-6rqg-c7f5enisa_euvd
- BIT-ruby-2021-33621osv
- BIT-ruby-min-2021-33621osv
- GHSA-vc47-6rqg-c7f5osv
sources
Which sources assert this record, and when.
references (29)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2021-33621/cnnvd
- https://lists.debian.org/debian-lts-announce/2023/06/msg00012.htmlcnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS/cnnvd
- https://packetstormsecurity.com/files/170671/Ubuntu-Security-Notice-USN-5806-2.htmlcnnvd
- https://security.netapp.com/advisory/ntap-20221228-0004/cnnvd
- https://vigilance.fr/vulnerability/Ruby-cgi-header-injection-39957cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan