OS Command Injection

2021-02-0304:10:54

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

69.7%

JSON

mechanize is vulnerable to OS command injection. The Kernel.open method could be used to inject and execute arbitrary OS commands invoked through several class methods. Exploitation is possible when untrusted input is used as a local filename and is passed to the affected functions.

CPENameOperatorVersion
mechanizele2.7.6
ruby-mechanize:sideq2.7.6-1
ruby-mechanize:bullseyeeq2.7.6-1
mechanizele2.7.6
ruby-mechanize:sideq2.7.6-1
ruby-mechanize:bullseyeeq2.7.6-1

Name	Operator	Version
mechanize	le	2.7.6
ruby-mechanize:sid	eq	2.7.6-1
ruby-mechanize:bullseye	eq	2.7.6-1
mechanize	le	2.7.6
ruby-mechanize:sid	eq	2.7.6-1
ruby-mechanize:bullseye	eq	2.7.6-1