CVEvulnerability
CVE-2014-4999
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-01-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.8 HIGH — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in the capture function and (2) mysql command line in the restore function, which allows local users to obtain sensitive information by listing the process.
Affected configurations
• kajam project kajam 1.0.3
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://www.openwall.com/lists/oss-security/2014/07/07/19 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/07/17/5 Mailing List, Third Party Advisory
- http://www.vapid.dhs.org/advisories/kajam-1.0.3.rc2.html Exploit, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/07/07/19 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/07/17/5 Mailing List, Third Party Advisory
- http://www.vapid.dhs.org/advisories/kajam-1.0.3.rc2.html Exploit, Third Party Advisory