CVE-2013-7111

Published: Apr 29, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The put_call function in the API client (api/api_client.rb) in the BaseSpace Ruby SDK (aka bio-basespace-sdk) gem 0.1.7 for Ruby uses the API_KEY on the command line, which allows remote attackers to obtain sensitive information by listing the processes.

Affected (1)

Products: Basespace Ruby Sdk Project: Basespace Ruby Sdk

Basespace Ruby Sdk Project

1 product

Basespace Ruby Sdk

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Basespace Ruby Sdk Project Basespace Ruby Sdk	Version 0.1.7

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

http://www.openwall.com/lists/oss-security/2013/12/14/2

Source: cve@mitre.org

Exploit

http://www.openwall.com/lists/oss-security/2013/12/15/5

Source: cve@mitre.org

http://www.vapid.dhs.org/advisories/bio-basespace-sdk.html

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2013/12/14/2

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.openwall.com/lists/oss-security/2013/12/15/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vapid.dhs.org/advisories/bio-basespace-sdk.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.