paratrooper-pingdom Gem for Ruby /lib/paratrooper-pingdom.rb API Login Credentials Local Disclosure

2013-12-2520:00:00

RubySec

nvd.nist.gov

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

JSON

paratrooper-pingdom Gem for Ruby contains a flaw in
/lib/paratrooper-pingdom.rb. The issue is triggered when the script exposes
API login credentials, allowing a local attacker to gain access to the API
key, username, and password for the API login by monitoring the process tree.