CVE-2007-0469

2007-01-2401:28:00

[email protected]

web.nvd.nist.gov

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.6

Confidence

High

EPSS

0.02

Percentile

88.9%

JSON

The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.

Affected configurations

Nvd

Node

rubyforgerubygemsRange≤0.9.0

rubyforgerubygemsMatch0.8.11

VendorProductVersionCPE
rubyforgerubygems*cpe:2.3:a:rubyforge:rubygems:*:*:*:*:*:*:*:*
rubyforgerubygems0.8.11cpe:2.3:a:rubyforge:rubygems:0.8.11:*:*:*:*:*:*:*