Path traversal

2013-12-1218:55:00

PRIOn knowledge base

www.prio-n.com

8 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

70.7%

JSON

The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.

CPENameOperatorVersion
sprouteq0.7.246

CPE	Name	Operator	Version
	sprout	eq	0.7.246

References

archives.neohapsis.com/archives/bugtraq/2013-12/0077.html

vapid.dhs.org/advisories/sprout-0.7.246-command-inj.html

www.openwall.com/lists/oss-security/2013/12/03/1

www.openwall.com/lists/oss-security/2013/12/03/6