GitHub Advisoryadvisory · RubyGems

GHSA-fjfg-q662-gm6j Moderate severity vulnerability that affects rails

MEDIUM Published 2017-10-24 Modified 2025-05-01 Official page ↗
Aliases
CVE-2007-5379
Ecosystem
RubyGems
Packages
rails
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2020-06-16

Affected packages

• RubyGems rails: < 1.2.4 → fixed in 1.2.4

Description

Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.

Related

Alias · CVE (1)

  • CVE-2007-5379 Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References