GitHub Advisoryadvisory · RubyGems
GHSA-p65m-qr5x-rrqq Webbynode Code Injection vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2013-7086
- Ecosystem
- RubyGems
- Packages
- webbynode
- Severity
- High
- Weaknesses
- CWE-94
- Reviewed
- 2020-06-16
Affected packages
• RubyGems webbynode: <= 1.0.5.3 (no fix yet)
Description
The message function in `lib/webbynode/notify.rb` in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message.
Related
Alias · CVE (1)
- CVE-2013-7086 The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to… vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-7086 advisory
- https://github.com/webbynode/webbynode/pull/85 web
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89705 web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/webbynode/CVE-2013-7086.yml web
- https://github.com/webbynode/webbynode package
- https://web.archive.org/web/20200229074410/http://www.securityfocus.com/bid/64289 web
- https://web.archive.org/web/20201208124343/http://www.vapid.dhs.org/advisories/webbynode-command-inj.html web
- http://packetstormsecurity.com/files/124421 web
- http://seclists.org/oss-sec/2013/q4/493 web
- http://seclists.org/oss-sec/2013/q4/497 web