GHSA-78j3-7wpm-qhvp

Suggest an improvement
Source
https://github.com/advisories/GHSA-78j3-7wpm-qhvp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-78j3-7wpm-qhvp/GHSA-78j3-7wpm-qhvp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-78j3-7wpm-qhvp
Aliases
  • CVE-2013-1947
Published
2017-10-24T18:33:37Z
Modified
2024-12-08T05:34:00.288112Z
Summary
Shell Metacharacter Injection in kelredd-pruview
Details

kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to document.rb, video.rb, or video_image.rb.

Database specific 
{
    "github_reviewed": true,
    "nvd_published_at": null,
    "severity": "CRITICAL",
    "github_reviewed_at": "2020-06-16T21:22:10Z",
    "cwe_ids": [
        "CWE-78"
    ]
}
References

Affected packages

RubyGems / kelredd-pruview

Package

Name
kelredd-pruview
Purl
pkg:gem/kelredd-pruview

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.5.0

Affected versions

0.*
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.11
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.4.0
0.4.1
0.5.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-78j3-7wpm-qhvp/GHSA-78j3-7wpm-qhvp.json"