CVE Feed

    Dashboard / CVE / CVE-2022-36073

    CVE-2022-36073

    RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable an attacker to save API keys for that account, and when a legitimate user attempts to create an account with their email (and has to reset password to gain access) and is granted access to other gems, the attacker would then be able to publish and yank versions of those gems. Commit number 90c9e6aac2d91518b479c51d48275c57de492d4d contains a patch for this issue.

    Published:Sep 7, 2022
    Last Modified:Apr 23, 2025
    EPS:Sep 7, 2022
    EPSS Score:0.00363
    CVSS Score:8.3

    Affected Products

    Vendor
    Rubygems
    Product
    Rubygems

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-287 Improper Authentication

    Related CVEs

    CVE-2026-82455 (CVSS 6.9) — RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When…
    CVE-2019-8322 (CVSS 7.5) — An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of…
    CVE-2019-8323 (CVSS 7.5) — An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may out…
    CVE-2019-8324 (CVSS 8.8) — An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not h…
    CVE-2019-8321 (CVSS 7.5) — An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say …
    CVE-2019-8325 (CVSS 7.5) — An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_err…
    CVE-2019-8320 (CVSS 7.4) — A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new direct…
    CVE-2018-1000075 (CVSS 7.5) — RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.…
    CVE-2018-1000078 (CVSS 6.1) — RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.…
    CVE-2018-1000076 (CVSS 9.8) — RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High