Lucene search
HistoryJan 24, 2007 - 1:28 a.m.
CVE-2007-0469
cve-2007-0469
rubygems
installer.rb
file overwrite
denial of service
arbitrary code execution
security vulnerability
7.5 High
AI Score
Confidence
Low
9.3 High
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.016 Low
EPSS
Percentile
87.5%
The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.
Affected configurations
Node
rubyforgerubygemsRange≤0.9.0
ORrubyforgerubygemsMatch0.8.11
| CPE | Name | Operator | Version |
|---|---|---|---|
| rubyforge:rubygems | rubyforge rubygems | le | 0.9.0 |
| rubyforge:rubygems | rubyforge rubygems | eq | 0.8.11 |
References
Related
osv
osv
RubyGems file overwrite vulnerability
2022-05-01 17:44:34
ubuntucve
ubuntucve
CVE-2007-0469
2007-01-24 00:00:00
nessus
nessus
openSUSE 10 Security Update : rubygems (rubygems-2644)
2007-10-17 00:00:00
cvelist
cvelist
CVE-2007-0469
2007-01-24 01:00:00
prion
prion
Code injection
2007-01-24 01:28:00
nvd
nvd
CVE-2007-0469
2007-01-24 01:28:00
github
github
RubyGems file overwrite vulnerability
2022-05-01 17:44:34
rubygems
rubygems
securityvulns
securityvulns
7.5 High
AI Score
Confidence
Low
9.3 High
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.016 Low
EPSS
Percentile
87.5%
Related for CVE-2007-0469