GitHub Advisoryadvisory · RubyGems

GHSA-c92m-rrrc-q5wf safemode gem allows context-dependent attackers to obtain sensitive information via the inspect method

HIGH Published 2017-10-24 Modified 2023-09-05 Official page ↗
Aliases
CVE-2016-3693
Ecosystem
RubyGems
Packages
safemode
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2020-06-16

Affected packages

• RubyGems safemode: < 1.2.4 → fixed in 1.2.4

Description

The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.

Related

Alias · CVE (1)

  • CVE-2016-3693 The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References