CVE-2014-4991

Published: Jan 10, 2018Modified: Nov 21, 2024

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.

Affected (1)

Products: Codders Dataset Project: Codders Dataset

Codders Dataset Project

1 product

Codders Dataset

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Codders Dataset Project Codders Dataset	Version 1.3.2.1

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (8)

http://www.openwall.com/lists/oss-security/2014/07/07/8

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2014/07/17/5

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/68733

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.vapid.dhs.org/advisories/codders-dataset-1.3.2.1.html

Source: cve@mitre.org

ExploitThird Party Advisory

http://www.openwall.com/lists/oss-security/2014/07/07/8

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2014/07/17/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/68733

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.vapid.dhs.org/advisories/codders-dataset-1.3.2.1.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.