Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2013-0334
HistoryOct 31, 2014 - 2:55 p.m.

CVE-2013-0334

2014-10-3114:55:02
CWE-20
[email protected]
web.nvd.nist.gov
45
nvd
cve-2013-0334
bundler
gem installation
security vulnerability

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

9.2 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.6%

JSON

Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

Affected configurations

NVD
Node
bundlerbundlerRange<1.7.0ruby
Node
opensuseopensuseMatch13.1
OR
opensuseopensuseMatch13.2
Node
fedoraprojectfedoraMatch19
OR
fedoraprojectfedoraMatch20
OR
fedoraprojectfedoraMatch21
CPENameOperatorVersion
bundler:bundlerbundlerlt1.7.0

Related

redhat 1
gentoo 1
fedora 3
ubuntucve 2
nvd 2
openvas 4
cvelist 2
nessus 9
centos 1
debiancve 2
github 2
oraclelinux 1
osv 2
prion 2
rubygems 1
redhatcve 1
cve 1
redhat
redhat
(RHSA-2015:2180) Moderate: rubygem-bundler and rubygem-thor security, bug fix, and enhancement update
2015-11-19 14:38:28
gentoo
gentoo
Bundler: Insecure installation
2016-09-26 00:00:00
fedora
fedora
[SECURITY] Fedora 19 Update: rubygem-bundler-1.7.3-1.fc19
2014-10-12 05:02:47
[SECURITY] Fedora 20 Update: rubygem-bundler-1.7.3-1.fc20
2014-10-12 05:07:22
[SECURITY] Fedora 21 Update: rubygem-bundler-1.7.3-1.fc21
2014-10-12 05:07:35
ubuntucve
ubuntucve
CVE-2013-0334
2014-10-31 00:00:00
CVE-2016-7954
2016-12-22 00:00:00
nvd
nvd
CVE-2013-0334
2014-10-31 14:55:02
CVE-2016-7954
2016-12-22 22:59:00
openvas
openvas
RedHat Update for rubygem-bundler and rubygem-thor RHSA-2015:2180-07
2015-11-20 00:00:00
Fedora Update for rubygem-bundler FEDORA-2014-11630
2014-10-13 00:00:00
Fedora Update for rubygem-bundler FEDORA-2014-11649
2014-10-13 00:00:00
cvelist
cvelist
CVE-2013-0334
2014-10-31 14:00:00
CVE-2016-7954
2016-12-22 22:00:00
nessus
nessus
CentOS 7 : rubygem-bundler / rubygem-thor (CESA-2015:2180)
2015-12-02 00:00:00
RHEL 7 : rubygem-bundler and rubygem-thor (RHSA-2015:2180)
2015-11-19 00:00:00
Fedora 19 : rubygem-bundler-1.7.3-1.fc19 (2014-11649)
2014-10-12 00:00:00
centos
centos
rubygem security update
2015-11-30 19:51:23
debiancve
debiancve
CVE-2013-0334
2014-10-31 14:55:02
CVE-2016-7954
2016-12-22 22:59:00
github
github
Bundler may install gems from a different source than expected
2022-05-05 02:48:48
Bundler allows attacker to inject arbitrary code via secondary Gem source
2022-05-14 00:57:16
oraclelinux
oraclelinux
rubygem-bundler and rubygem-thor security, bug fix, and enhancement update
2015-11-23 00:00:00
osv
osv
Bundler may install gems from a different source than expected
2022-05-05 02:48:48
Bundler allows attacker to inject arbitrary code via secondary Gem source
2022-05-14 00:57:16
prion
prion
Code injection
2014-10-31 14:55:00
Design/Logic Flaw
2016-12-22 22:59:00
rubygems
rubygems
CVE-2013-0334 rubygem-bundler: 'bundle install' may install a gem from a source other than expected
2014-08-12 20:00:00
redhatcve
redhatcve
CVE-2016-7954
2016-10-05 12:47:20
cve
cve
CVE-2016-7954
2016-12-22 22:59:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

9.2 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.6%

JSON
Related for CVE-2013-0334
redhat1gentoo1fedora3ubuntucve2nvd2openvas4cvelist2nessus9centos1debiancve2github2oraclelinux1osv2prion2rubygems1redhatcve1cve1