Vulnerability Details : CVE-2007-5379
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
Vulnerability category: Information leak
Products affected by CVE-2007-5379
- cpe:2.3:a:david_hansson:ruby_on_rails:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2007-5379
0.87%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 82 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2007-5379
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2007-5379
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2007-5379
-
http://www.vupen.com/english/advisories/2007/4238
Webmail: access your OVH emails on ovhcloud.com | OVHcloud
-
http://docs.info.apple.com/article.html?artnum=307179
-
http://www.vupen.com/english/advisories/2007/3508
Webmail: access your OVH emails on ovhcloud.com | OVHcloud
-
http://dev.rubyonrails.org/ticket/8453
-
http://www.us-cert.gov/cas/techalerts/TA07-352A.html
Page Not Found | CISAUS Government Resource
-
http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
Ruby on Rails — Rails 1.2.4: Maintenance release
-
http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
-
http://bugs.gentoo.org/show_bug.cgi?id=195315
195315 – dev-ruby/rails <1.2.5 Multiple vulnerabilities (CVE-2007-{3227,5379,5380})
-
http://www.securityfocus.com/bid/26096
Patch
-
http://security.gentoo.org/glsa/glsa-200711-17.xml
Ruby on Rails: Multiple vulnerabilities (GLSA 200711-17) — Gentoo security
Jump to