CVE-2021-43840
Path traversal in message_bus
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
message_bus is a messaging bus for Ruby processes and web clients. In versions prior to 3.3.7 users who deployed message bus with diagnostics features enabled (default off) are vulnerable to a path traversal bug, which could lead to disclosure of secret information on a machine if an unintended user were to gain access to the diagnostic route. The impact is also greater if there is no proxy for your web application as the number of steps up the directories is not bounded. For deployments which uses a proxy, the impact varies. For example, If a request goes through a proxy like Nginx with `merge_slashes` enabled, the number of steps up the directories that can be read is limited to 3 levels. This issue has been patched in version 3.3.7. Users unable to upgrade should ensure that MessageBus::Diagnostics is disabled.
Timeline
ID reserved
By GitHub_M
- 31 days later
· 31 days later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium4.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Modified | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 1.9% · top 20% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.4.
Weakness
Affected products
- affected < 3.3.7
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- RubyGemsmessage_busGHSA-xmgj-5fh3-xjmm (opens in a new tab)
References (2)
- https://github.com/discourse/message_bus/security/advisories/GHSA-xmgj-5fh3-xjmm (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/discourse/message_bus/commit/9b6deee01ed474c7e9b5ff65a06bb0447b4db2ba (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-xmgj-5fh3-xjmm (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2021-43840)Record last updated .