{"id":"CVE-2015-4410","aliases":["DEBIAN-CVE-2015-4410","EUVD-2020-0619","GHSA-f93j-hmcr-jcwh","SUSE-SU-2016:2019-1","UBUNTU-CVE-2015-4410"],"status":"published","title":"Moped Rubygem Data Injection Vulnerability","description":"The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.05661,"percentile":0.93042,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-08-09T18:27:03Z","modified":"2026-09-09T07:01:18Z","fixes":[{"ecosystem":"RubyGems","package":"moped","fixed_in":["1.5.3","2.0.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-bson","fixed_in":["1.10.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-bson","fixed_in":["1.10.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-bson","fixed_in":["1.10.0-2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"rubygem-bson-1_11","fixed_in":["1.11.1-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"rubygem-easy_diff","fixed_in":["0.0.5-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"rubygem-redcarpet","fixed_in":["3.2.3-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"rubygem-sprockets-2_11","fixed_in":["2.11.3-11.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"moped","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"moped","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-2"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"moped","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3"}]}],"versions":["0.0.0.beta","1.0.0","1.0.0.alpha","1.0.0.beta","1.0.0.rc","1.0.1","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.2.1","1.2.2","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.5.0","1.5.1","1.5.2"]},{"source":"osv","ecosystem":"RubyGems","package":"moped","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.5"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4"]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"rubygem-bson-1_11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"rubygem-easy_diff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.5-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"rubygem-redcarpet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"rubygem-sprockets-2_11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3-11.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"moped_project","product":"moped"}],"references":[{"url":"https://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","advisory","evidence","web"]},{"url":"https://homakov.blogspot.ru/2012/05/saferweb-injects-in-various-ruby.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","advisory","evidence","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161987.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161964.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1229757","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","advisory","report","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/06/06/3","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"http://www.securityfocus.com/bid/75045","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/mongoid/moped/commit/dd5a7c14b5d2e466f7875d079af71ad19774609b#diff-3b93602f64c2fe46d38efd9f73ef5358R24","tags":["x_refsource_MISC","x_transferred","Exploit","evidence","web"]},{"url":"https://seclists.org/oss-sec/2015/q2/653","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"https://www.securityfocus.com/bid/75045","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-4410","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/moped/CVE-2015-4410.yml","tags":["web"]},{"url":"http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html","tags":["web","report"]},{"url":"https://web.archive.org/web/20200228085849/http://www.securityfocus.com/bid/75045","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f93j-hmcr-jcwh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-4410","tags":["advisory"]},{"url":"https://github.com/mongoid/moped","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162019-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/926328","tags":["report"]},{"url":"https://bugzilla.suse.com/933961","tags":["report"]},{"url":"https://bugzilla.suse.com/982364","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4410","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-4410","tags":["report"]},{"url":"https://sources.debian.net/src/ruby-bson/1.10.0-1/lib/bson/types/object_id.rb/#L54","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/06/06/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-4410","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-4410","description":"The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.","status":"published","published":"2020-02-20T16:24:26Z","modified":"2024-08-06T06:11:13.071Z","updated_at":"2026-11-02T14:35:43.698357Z"}],"euvd":[{"id":"EUVD-2020-0619","description":"The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.","status":"published","published":"2020-02-20T16:24:26Z","modified":"2024-08-06T06:11:13Z","updated_at":"2026-11-03T02:22:04.101765Z"}],"ghsa":[{"id":"GHSA-f93j-hmcr-jcwh","title":"Moped Rubygem Data Injection Vulnerability","description":"`The Moped::BSON::ObjecId.legal?` method in rubygem-moped before [commit dd5a7c14b5d2e466f7875d079af71ad19774609b](https://github.com/mongoid/moped/commit/dd5a7c14b5d2e466f7875d079af71ad19774609b#diff-3b93602f64c2fe46d38efd9f73ef5358R24) allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.","status":"published","published":"2020-08-19T16:45:49Z","modified":"2023-08-25T21:39:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:00.680009Z"}],"nvd":[{"id":"CVE-2015-4410","description":"The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.","status":"published","published":"2020-02-20T17:15:12.587Z","modified":"2026-06-17T00:27:14.487Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:19.73542Z"}],"osv":[{"id":"CVE-2015-4410","description":"The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.","status":"published","published":"2020-02-20T17:15:12Z","modified":"2026-04-10T03:45:18.952084Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-4410","description":"The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.","status":"published","published":"2020-02-20T17:15:12.587Z","modified":"2026-09-09T07:01:18.724373566Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"GHSA-f93j-hmcr-jcwh","title":"Moped Rubygem Data Injection Vulnerability","description":"`The Moped::BSON::ObjecId.legal?` method in rubygem-moped before [commit dd5a7c14b5d2e466f7875d079af71ad19774609b](https://github.com/mongoid/moped/commit/dd5a7c14b5d2e466f7875d079af71ad19774609b#diff-3b93602f64c2fe46d38efd9f73ef5358R24) allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.","status":"published","published":"2020-08-19T16:45:49Z","modified":"2024-02-16T08:10:02.211472Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"UBUNTU-CVE-2015-4410","description":"The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.","status":"withdrawn","published":"2020-02-20T17:15:00Z","modified":"2025-07-16T07:33:00.47881Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"SUSE-SU-2016:2019-1","title":"Security update for rubygem-bson-1_11, rubygem-easy_diff, rubygem-redcarpet, and rubygem-sprockets-2_11","description":"\nThis update for rubygem-bson-1_11, rubygem-easy_diff, rubygem-redcarpet, and rubygem-sprockets-2_11 fixes the following issues: \n\n- Avoid monodb data injection (bnc#933961, CVE-2015-4410)\n- Fixes merging of Arrays of Hashes (bsc#982364)\n- Fix XSS via autolinking of untrusted markdown (bsc#926328)\n\n","status":"published","published":"2016-08-09T18:27:03Z","modified":"2026-02-04T03:05:27.280988Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}