GitHub Advisoryadvisory · RubyGems
GHSA-mc8m-x6hf-cw2g point-cli allows local users to obtain sensitive information by listing the process
HIGH
Official page ↗
- Aliases
- CVE-2014-4997
- Ecosystem
- RubyGems
- Packages
- point-cli
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-200
- Reviewed
- 2023-01-27
Affected packages
• RubyGems point-cli: <= 0.0.1 (no fix yet)
Description
`lib/commands/setup.rb` in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
Related
Alias · CVE (1)
- CVE-2014-4997 lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain… vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-4997 advisory
- https://web.archive.org/web/20200229054941/http://www.securityfocus.com/bid/68735 web
- http://www.openwall.com/lists/oss-security/2014/07/07/16 web
- http://www.openwall.com/lists/oss-security/2014/07/17/5 web
- http://www.vapid.dhs.org/advisories/point-cli-0.0.1.html web