GitHub Advisoryadvisory · RubyGems

GHSA-94cq-7ccq-cmcm lynx doesn't properly sanitize user input and exposes database password to unauthorized users

HIGH Published 2018-01-24 Modified 2023-01-23 Official page ↗
Aliases
CVE-2014-5002
Ecosystem
RubyGems
Packages
lynx
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2020-06-16

Affected packages

• RubyGems lynx: < 1.0.0 → fixed in 1.0.0

Description

The lynx gem prior to 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes. As of version 1.0.0, lynx no longer supports a `--password` option. Passwords are only configured in a configuration file, so it's no longer possible to expose passwords on the command line.

Related

Alias · CVE (1)

  • CVE-2014-5002 The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References