PT-2018-4239 · Ruby · Point-Cli

Larry W. Cashdollar + 1 · Publicado 2018-01-10 · Atualizado 2022-05-14 · CVE-2014-4997

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions point-cli gem version 0.0.1

Description The issue allows local users to obtain sensitive information by listing the process, as credentials are placed on the curl command line in the lib/commands/setup.rb file of the point-cli gem for Ruby.

Recommendations For point-cli gem version 0.0.1, consider restricting access to sensitive information and avoid using the lib/commands/setup.rb file until a fix is available. As a temporary workaround, consider modifying the lib/commands/setup.rb file to handle credentials securely, such as using environment variables or a secure storage mechanism for sensitive information.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-4997

GHSA-MC8M-X6HF-CW2G

Produtos afetados

Point-Cli

Referências · 7

• 🔥 http://vapid.dhs.org/advisories/point-cli-0.0.1.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-4997 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/07/07/16 · Nota
• https://web.archive.org/web/20200229054941/http://securityfocus.com/bid/68735 · Nota
• http://securityfocus.com/bid/68735 · Nota
• https://osv.dev/vulnerability/GHSA-mc8m-x6hf-cw2g · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/07/17/5 · Nota