CVE-2014-1233 Local API Login Credentials Disclosure in paratrooper-pingdom
LowCVSS 2.1
EPSS 0.41%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems paratrooper-pingdom(RubyGems) | <= 1.0.0 | No fix listed |
| rubygems paratrooper-pingdom(RubyGems) | = 1.0.0 | No fix listed |
| tobias maier paratrooper-pingdom | = 1.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- [oss-security] 20140107 paratrooper-pingdom-1.0.0 ruby gem exposes API login credentials exploit mailing-list
- www.vapid.dhs.org exploit
- github.com exploit