GitHub Advisoryadvisory · RubyGems

GHSA-5g7f-p7jg-v6mv lean-ruport allows local users to obtain sensitive information by listing the process

HIGH Published 2022-05-14 Modified 2023-01-26 Official page ↗
Aliases
CVE-2014-4998
Ecosystem
RubyGems
Packages
lean-ruport
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2023-01-26

Affected packages

• RubyGems lean-ruport: <= 0.3.8 (no fix yet)

Description

`test/tc_database.rb` in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.

Related

Alias · CVE (1)

  • CVE-2014-4998 test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References