GitHub Advisoryadvisory · RubyGems

GHSA-88p8-4vv5-82j7 xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table

MEDIUM Published 2023-01-26 Modified 2023-12-14 Official page ↗
Aliases
CVE-2015-2179
Ecosystem
RubyGems
Packages
xaviershay-dm-rails
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-01-26

Affected packages

• RubyGems xaviershay-dm-rails: <= 1.2.0 (no fix yet)

Description

xaviershay-dm-rails Gem for Ruby contains a flaw in the `execute()` function in `/datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb`. The issue is due to the function exposing sensitive information via the process table. This may allow a local attack to gain access to MySQL credential information.

Related

Alias · CVE (1)

  • CVE-2015-2179 The xaviershay-dm-rails gem 0.10.3.8 for Ruby allows local users to discover MySQL credentials by listing a process and its arguments. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References