GitHub Advisoryadvisory · RubyGems

GHSA-85gf-wr67-f83w curupira is vulnerable to SQL injection

CRITICAL Published 2023-01-16 Modified 2023-01-24 Official page ↗
Aliases
CVE-2015-10053
Ecosystem
RubyGems
Packages
curupira
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2023-01-18

Affected packages

• RubyGems curupira: < 0.1.4 → fixed in 0.1.4

Description

A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown function of the file app/controllers/curupira/passwords_controller.rb. The manipulation leads to sql injection. Upgrading to version 0.1.4 is able to address this issue. The name of the patch is 93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the affected component. VDB-218394 is the identifier assigned to this vulnerability.

Related

Alias · CVE (1)

  • CVE-2015-10053 A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References