GHSA-vm28-mrm7-fpjq
Suggest an improvement- Source
- https://github.com/advisories/GHSA-vm28-mrm7-fpjq
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-vm28-mrm7-fpjq/GHSA-vm28-mrm7-fpjq.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-vm28-mrm7-fpjq
- Aliases
-
- CVE-2014-2888
- Published
- 2017-10-24T18:33:36Z
- Modified
- 2024-12-03T06:07:34.614720Z
- Summary
- sfpagent Command Injection vulnerability
- Details
-
lib/sfpagent/bsig.rbin the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request. - Database specific
{ "nvd_published_at": "2014-04-23T15:55:00Z", "cwe_ids": [ "CWE-77" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-06-16T21:57:58Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2014-2888
- https://github.com/herry13/sfpagent
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sfpagent/CVE-2014-2888.yml
- https://web.archive.org/web/20201029141944/http://www.vapid.dhs.org/advisories/spfagent-remotecmd.html
- http://seclists.org/fulldisclosure/2014/Apr/243
- http://www.openwall.com/lists/oss-security/2014/04/16/1
- http://www.openwall.com/lists/oss-security/2014/04/18/4
- http://www.vapid.dhs.org/advisories/spfagent-remotecmd.html
Affected packages
RubyGems / sfpagent
Package
- Name
- sfpagent
- Purl
- pkg:gem/sfpagent
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed0.4.15
Affected versions
0.*
0.0.1
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.9
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.3.9
0.3.10
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.4.10
0.4.11
0.4.12
0.4.13
0.4.14