Описание
vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in the capture function and (2) mysql command line in the restore function, which allows local users to obtain sensitive information by listing the process.
Ссылки
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- ExploitThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:kajam_project:kajam:1.0.3:rc2:*:*:*:ruby:*:*
EPSS
Процентиль: 17%
0.00054
Низкий
7.8 High
CVSS3
2.1 Low
CVSS2
Дефекты
CWE-200
Связанные уязвимости
CVSS3: 7.8
github
больше 3 лет назад
kajam allows local users to obtain sensitive information by listing the process
EPSS
Процентиль: 17%
0.00054
Низкий
7.8 High
CVSS3
2.1 Low
CVSS2
Дефекты
CWE-200