Lucene search

[email protected]CVE-2013-6421

HistoryDec 12, 2013 - 6:55 p.m.

CVE-2013-6421

2013-12-1218:55:16

CWE-94

[email protected]

web.nvd.nist.gov

cve-2013-6421

sprout gem

ruby

arbitrary command execution

security vulnerability

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.6 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

70.7%

JSON

The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.

Affected configurations

NVD

Node

projectsproutssproutMatch0.7.246---ruby

CPENameOperatorVersion
projectsprouts:sproutprojectsprouts sprouteq0.7.246

CPE	Name	Operator	Version
projectsprouts:sprout	projectsprouts sprout	eq	0.7.246

References

archives.neohapsis.com/archives/bugtraq/2013-12/0077.html

vapid.dhs.org/advisories/sprout-0.7.246-command-inj.html

www.openwall.com/lists/oss-security/2013/12/03/1

www.openwall.com/lists/oss-security/2013/12/03/6

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.6 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

70.7%

JSON

Related for CVE-2013-6421

nvd1 prion1 cvelist1 github1 osv1 kitploit1