adamzaninovich/sounder · Security
Sounder Contains Arbitrary Command Execution Vulnerability
- GHSA ID
- GHSA-rfmf-rx8w-935w
- CVE ID
- CVE-2013-5647
- Severity
- high
- Published
- Updated
Description
lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
CWEs
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-5647 ↗
- https://github.com/advisories/GHSA-rfmf-rx8w-935w ↗
- http://vapid.dhs.org/advisories/sounder-ruby-gem-cmd-inj.html ↗
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sounder/CVE-2013-5647.yml ↗
- https://github.com/adamzaninovich/sounder/blob/v1.0.1/lib/sounder/sound.rb ↗