Improper Neutralization of Escape, Meta, or Control Sequences
CVE-2022-30123
Summary
A sequence injection vulnerability exists in Rack prior to 2.0.9.1, 2.1.x prior to 2.1.4.1, and 2.2.x prior to 2.2.3.1 which could allow is a possible shell escape in the "Lint" and "CommonLogger" components of Rack.
- LOW
- NETWORK
- HIGH
- CHANGED
- NONE
- NONE
- HIGH
- HIGH
CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
References
Advisory Timeline
- Published