CVE-2013-1911

Published: Apr 3, 2013Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.

Affected (1)

Products: Mark Burns: Ldoce

Mark Burns

1 product

Ldoce

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mark Burns Ldoce	Version 0.0.2

Running on/with	Platform Versions
Ruby Lang Ruby	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (12)

http://archives.neohapsis.com/archives/bugtraq/2013-04/0010.html

Source: secalert@redhat.com

Exploit

http://osvdb.org/91870

Source: secalert@redhat.com

http://otiose.dhs.org/advisories/ldoce-0.0.2-cmd-exec.html

Source: secalert@redhat.com

Exploit

http://www.openwall.com/lists/oss-security/2013/03/31/3

Source: secalert@redhat.com

Exploit

http://www.securityfocus.com/bid/58783

Source: secalert@redhat.com

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/83163

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/bugtraq/2013-04/0010.html