CVE-2023-27530
Full vulnerability record from the local CVENow database.
Description
A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2023-03-10 22:15:10.497000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2023-27530",
"sourceIdentifier": "[email protected]",
"published": "2023-03-10T22:15:10.497",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected."
},
{
"lang": "es",
"value": "Una vulnerabilidad de DoS existe en Rack anterior a v3.0.4.2, anterior a v2.2.6.3, anterior a v2.1.4.3 y anterior a v2.0.9.3 dentro del código de análisis de MIME multiparte, en el que podría permitir a un atacante crear solicitudes que pueden ser abusadas para hacer que el análisis multiparte tarde más de lo esperado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n/a",
"product": "https://github.com/rack/rack",
"versions": [
{
"version": "3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2024-10-15T17:29:06.360143Z",
"id": "CVE-2023-27530",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-400"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
"versionEndExcluding": "2.0.9.3",
"matchCriteriaId": "C1EDB027-19EA-4F3A-A3A1-46E03D679C7C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
"versionStartIncluding": "2.1.0",
"versionEndExcluding": "2.1.4.3",
"matchCriteriaId": "8ECC0192-9B71-4425-AE18-EDE8A7488392"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
"versionStartIncluding": "2.2.0",
"versionEndExcluding": "2.2.6.3",
"matchCriteriaId": "FCBE71F2-9736-4E4D-8A71-2D1FF559A9F1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
"versionStartIncluding": "3.0.0",
"versionEndExcluding": "3.0.4.2",
"matchCriteriaId": "33317DE1-F0A7-4DB2-9F7C-20084C9035BD"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
]
}
]
}
],
"references": [
{
"url": "https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388",
"source": "[email protected]",
"tags": [
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00017.html",
"source": "[email protected]",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "https://security.netapp.com/advisory/ntap-20231208-0015/",
"source": "[email protected]"
},
{
"url": "https://www.debian.org/security/2023/dsa-5530",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00017.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "https://security.netapp.com/advisory/ntap-20231208-0015/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2023/dsa-5530",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
}
]
}