GitHub Advisoryadvisory · RubyGems

GHSA-q97v-764g-r2rp gollum and gollum-lib allow remote authenticated users to execute arbitrary code

HIGH Published 2017-11-16 Modified 2023-01-23 Official page ↗
Aliases
CVE-2014-9489
Ecosystem
RubyGems
Packages
gollum, gollum-lib
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2020-06-16

Affected packages

• RubyGems gollum: < 3.1.1 → fixed in 3.1.1 • RubyGems gollum-lib: < 4.0.1 → fixed in 4.0.1

Description

The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string `master` is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the `-O` or `--open-files-in-pager` flags.

Related

Alias · CVE (1)

  • CVE-2014-9489 The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References