CVE-2013-2090

2014-05-2715:00:00

CWE-78

[email protected]

web.nvd.nist.gov

creme fraiche

ruby

cve-2013-2090

remote command execution

email attachment

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.8 High

AI Score

Confidence

Low

0.014 Low

EPSS

Percentile

86.5%

JSON

The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment. NOTE: some of these details are obtained from third party information.

Affected configurations

NVD

Node

uplawskicreme_fraicheRange≤0.6ruby

uplawskicreme_fraicheMatch0.4.5ruby

uplawskicreme_fraicheMatch0.4.5.1ruby

uplawskicreme_fraicheMatch0.4.5.2ruby

uplawskicreme_fraicheMatch0.4.5.4ruby

uplawskicreme_fraicheMatch0.4.5.5ruby

uplawskicreme_fraicheMatch0.4.5.6ruby

uplawskicreme_fraicheMatch0.5ruby

uplawskicreme_fraicheMatch0.5.1ruby

uplawskicreme_fraicheMatch0.5.2ruby

uplawskicreme_fraicheMatch0.5.3ruby

CPENameOperatorVersion
uplawski:creme_fraicheuplawski creme fraichele0.6
uplawski:creme_fraicheuplawski creme fraicheeq0.4.5
uplawski:creme_fraicheuplawski creme fraicheeq0.4.5.1
uplawski:creme_fraicheuplawski creme fraicheeq0.4.5.2
uplawski:creme_fraicheuplawski creme fraicheeq0.4.5.4
uplawski:creme_fraicheuplawski creme fraicheeq0.4.5.5
uplawski:creme_fraicheuplawski creme fraicheeq0.4.5.6
uplawski:creme_fraicheuplawski creme fraicheeq0.5
uplawski:creme_fraicheuplawski creme fraicheeq0.5.1
uplawski:creme_fraicheuplawski creme fraicheeq0.5.2

CPE	Name	Operator	Version
uplawski:creme_fraiche	uplawski creme fraiche	le	0.6
uplawski:creme_fraiche	uplawski creme fraiche	eq	0.4.5
uplawski:creme_fraiche	uplawski creme fraiche	eq	0.4.5.1
uplawski:creme_fraiche	uplawski creme fraiche	eq	0.4.5.2
uplawski:creme_fraiche	uplawski creme fraiche	eq	0.4.5.4
uplawski:creme_fraiche	uplawski creme fraiche	eq	0.4.5.5
uplawski:creme_fraiche	uplawski creme fraiche	eq	0.4.5.6
uplawski:creme_fraiche	uplawski creme fraiche	eq	0.5
uplawski:creme_fraiche	uplawski creme fraiche	eq	0.5.1
uplawski:creme_fraiche	uplawski creme fraiche	eq	0.5.2