Lucene search

GitHub Advisory DatabaseGHSA-RFMF-RX8W-935W

HistoryOct 24, 2017 - 6:33 p.m.

Sounder Contains Arbitrary Command Execution Vulnerability

2017-10-2418:33:37

CWE-94

GitHub Advisory Database

github.com

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.004

Percentile

75.1%

JSON

lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.

Affected configurations

Vulners

Node

sounderRange<1.0.2

VendorProductVersionCPE
*sounder*cpe:2.3:a:*:sounder:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	sounder	*	cpe:2.3:a::sounder::::::::*

References

vapid.dhs.org/advisories/sounder-ruby-gem-cmd-inj.html

github.com/adamzaninovich/sounder/blob/v1.0.1/lib/sounder/sound.rb

github.com/advisories/GHSA-rfmf-rx8w-935w

github.com/rubysec/ruby-advisory-db/blob/master/gems/sounder/CVE-2013-5647.yml

nvd.nist.gov/vuln/detail/CVE-2013-5647

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.004

Percentile

75.1%

JSON

Related for GHSA-RFMF-RX8W-935W