$ cve CVE-2008-3655 JSON

CVE-2008-3655 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 14.1% (pctl 96)

Patch early

A public exploit exists.

Description

Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	14.09% — more likely to be exploited than 96% of all CVEs
Weakness	CWE-264
On CISA KEV	no
Public exploit	yes
Published	2008-08-13
Last modified	2026-06-16

Affected (1)

Vendor	Product
ruby-lang	ruby

Public exploits

Source	Title	Date
exploit-db	Ruby 1.9 dl - Module DL.dlopen Arbitrary Library Access	2008-08-11
exploit-db	Ruby 1.9 - Safe Level Multiple Function Restriction Bypass	2008-08-11

References

→ the Explorer · watch your stack · NVD