Design/Logic Flaw

2018-01-1018:29:00

PRIOn knowledge base

www.prio-n.com

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.

CPENameOperatorVersion
codders-dataseteq1.3.2.1

CPE	Name	Operator	Version
	codders-dataset	eq	1.3.2.1

References

www.openwall.com/lists/oss-security/2014/07/07/8

www.openwall.com/lists/oss-security/2014/07/17/5

www.securityfocus.com/bid/68733

www.vapid.dhs.org/advisories/codders-dataset-1.3.2.1.html