Lucene search

RedhatCVE-2013-1898

HistoryApr 09, 2013 - 8:55 p.m.

CVE-2013-1898

2013-04-0920:55:02

CWE-94

redhat

web.nvd.nist.gov

cve

2013

1898

ruby

gem

thumbshooter

remote

command execution

security vulnerability

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.9

Confidence

Low

EPSS

0.008

Percentile

81.9%

JSON

lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.

Affected configurations

Nvd

Node

digineothumbshooterMatch0.1.5

VendorProductVersionCPE
digineothumbshooter0.1.5cpe:2.3:a:digineo:thumbshooter:0.1.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
digineo	thumbshooter	0.1.5	cpe:2.3:a:digineo:thumbshooter:0.1.5:::::::*

References

osvdb.org/91839

seclists.org/fulldisclosure/2013/Mar/218

vapid.dhs.org/advisories/thumbshooter-ruby-gem-remoteexec.html

www.openwall.com/lists/oss-security/2013/03/26/13

www.openwall.com/lists/oss-security/2013/03/26/3

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.9

Confidence

Low

EPSS

0.008

Percentile

81.9%

JSON

Related for CVE-2013-1898