GitHub Advisoryadvisory · RubyGems

GHSA-5vx5-9q73-wgp4 Safemode Gem Has Incomplete List of Disallowed Inputs

CRITICAL Published 2017-10-24 Modified 2023-09-05 Official page ↗
Aliases
CVE-2017-7540
Ecosystem
RubyGems
Packages
safemode
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-184
Reviewed
2020-06-16

Affected packages

• RubyGems safemode: < 1.3.2 → fixed in 1.3.2

Description

rubygem-safemode, as used in Foreman, versions 1.3.1 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.

Related

Alias · CVE (1)

  • CVE-2017-7540 rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. vulnerability

Weakness · CWE (1)

  • CWE-184 Incomplete List of Disallowed Inputs weakness

References