GitHub Advisoryadvisory · RubyGems
GHSA-9x97-x2p9-hvpf Fileutils Command Injection vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2013-2516
- Ecosystem
- RubyGems
- Packages
- fileutils
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-77
- Reviewed
- 2023-03-10
Affected packages
• RubyGems fileutils: < 0.7.1 → fixed in 0.7.1
Description
Ruby Gem Fileutils prior to v0.7.1 contains a Command Injection vulnerability in user supplied url variable that is passed to the shell.
Related
Alias · CVE (1)
- CVE-2013-2516 Vulnerability in FileUtils v0.7, Ruby Gem Fileutils <= v0.7 Command Injection vulnerability in user supplied url variable that is passed to… vulnerability
Weakness · CWE (1)
- CWE-77 Improper Neutralization of Special Elements used in a Command weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-2516 advisory
- https://github.com/ruby/fileutils/commit/994c7aa1ba391689f844a069b9aee9e49813686c web
- https://bugs.ruby-lang.org/issues/7958 web
- https://github.com/ruby/fileutils package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fileutils/CVE-2013-2516.yml web
- http://rubygems.org/gems/fileutils web
- http://www.vapidlabs.com/advisory.php?v=36 web