ruby/fileutils · Security
Fileutils Command Injection vulnerability
- GHSA ID
- GHSA-9x97-x2p9-hvpf
- CVE ID
- CVE-2013-2516
- Severity
- high
- Published
- Updated
- CVSS
- 8.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3
- 8.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
Ruby Gem Fileutils prior to v0.7.1 contains a Command Injection vulnerability in user supplied url variable that is passed to the shell.
CWEs
- CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-2516 ↗
- http://rubygems.org/gems/fileutils ↗
- http://www.vapidlabs.com/advisory.php?v=36 ↗
- https://github.com/ruby/fileutils/commit/994c7aa1ba391689f844a069b9aee9e49813686c ↗
- https://bugs.ruby-lang.org/issues/7958 ↗
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fileutils/CVE-2013-2516.yml ↗
- https://github.com/advisories/GHSA-9x97-x2p9-hvpf ↗