PT-2019-6893 · Fileutil · Fileutils

Larry W. Cashdollar + 1 · Published 2019-02-15 · Updated 2022-05-14 · CVE-2013-2516

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fileutils versions prior to 0.7.1

Description The issue concerns a Command Injection vulnerability. It occurs when a user-supplied url variable is passed to the shell, allowing for potential command injection.

Recommendations For versions prior to 0.7.1, update to version 0.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of user-supplied url variables in the affected function until a patch is available. Avoid using the url variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2013-2516

GHSA-9X97-X2P9-HVPF

Affected Products

Fileutils

References · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fileutils/CVE-2013-2516.yml · Exploit
• 🔥 http://vapidlabs.com/advisory.php?v=36 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-2516 · Security Note
• https://osv.dev/vulnerability/GHSA-9x97-x2p9-hvpf · Vendor Advisory
• https://github.com/ruby/fileutils/commit/994c7aa1ba391689f844a069b9aee9e49813686c · Note
• https://github.com/ruby/fileutils · Note
• https://bugs.ruby-lang.org/issues/7958 · Note
• http://rubygems.org/gems/fileutils · Note