GitHub Advisoryadvisory · RubyGems

GHSA-rhgq-vv9x-j4p5 lawn-login exposes database password to unauthorized users

HIGH Published 2018-01-22 Modified 2023-07-31 Official page ↗
Aliases
CVE-2014-5000
Ecosystem
RubyGems
Packages
lawn-login
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2020-06-16

Affected packages

• RubyGems lawn-login: 0.0.7 (no fix yet)

Description

The login function in `lib/lawn.rb` in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.

Related

Alias · CVE (1)

  • CVE-2014-5000 The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References