CVE-2015-3900

MEDIUM · CVSS 5 EPSS 8.93%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2015-06-24 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE

CVE-2015-3900

Severity

MEDIUM

CVSS

EPSS

8.93%

Original NVD Description

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."