CVE-2017-0909

Published: Nov 16, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.

Affected (1)

Products: Private Address Check Project: Private Address Check

Private Address Check Project

1 product

Private Address Check

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Private Address Check Project Private Address Check	Before 0.4.1

Related CWEs

CWE-184

Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

References (4)

https://github.com/jtdowney/private_address_check/pull/3

Source: support@hackerone.com

Issue TrackingThird Party Advisory

https://hackerone.com/reports/288950

Source: support@hackerone.com

Issue TrackingPatchThird Party Advisory

https://github.com/jtdowney/private_address_check/pull/3

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://hackerone.com/reports/288950

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

Timeline

No history available yet.