CVE-2014-4992 - lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process

Back Back to CVE browser

HIGH

lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process

Published Jan 10, 2018

7.8

HIGH

CVSS 3.0

EPSS 0.52%

Description

lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (6)

http://www.openwall.com/lists/oss-security/2014/07/07/9
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/17/5
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.vapid.dhs.org/advisories/cap-strap-0.1.5.html
x_refsource_MISCExploitThird Party Advisory
https://github.com/advisories/GHSA-pcm6-g2qp-9gw8
Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cap-strap/CVE-2014-4992.yml
https://nvd.nist.gov/vuln/detail/CVE-2014-4992

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2014/07/07/9		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/17/5		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.vapid.dhs.org/advisories/cap-strap-0.1.5.html		x_refsource_MISCExploitThird Party Advisory
https://github.com/advisories/GHSA-pcm6-g2qp-9gw8		Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cap-strap/CVE-2014-4992.yml
https://nvd.nist.gov/vuln/detail/CVE-2014-4992