PT-2023-10312 · Oracle · Mysql Server

Larry W. Cashdollar + 1 · Publicado 2023-01-26 · Atualizado 2023-12-14 · CVE-2015-2179

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions xaviershay-dm-rails gem version 0.10.3.8

Description The issue allows local users to discover MySQL credentials by listing a process and its arguments. This is due to a flaw in the execute() function in the /datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb file, which exposes sensitive information via the process table. A local attack may gain access to MySQL credential information.

Recommendations For xaviershay-dm-rails gem version 0.10.3.8, consider disabling the execute() function in the /datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb file as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-2179

GHSA-88P8-4VV5-82J7

Produtos afetados

Mysql Server

Referências · 5

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/xaviershay-dm-rails/CVE-2015-2179.yml · Exploit
• 🔥 http://vapid.dhs.org/advisory.php?v=115 · Exploit
• https://github.com/datamapper/dm-rails · Nota
• https://osv.dev/vulnerability/GHSA-88p8-4vv5-82j7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-2179 · Nota de Segurança