CVE-2014-2322 Arabic Prawn allows remote attackers to execute arbitrary commands via shell metacharacters
HighCVSS 7.5
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems arabic-prawn(RubyGems) | <= 0.0.1 | No fix listed |
| rubygems arabic-prawn(RubyGems) | = 0.0.1 | No fix listed |
| dynamixsolutions arabic prawn | = 0.0.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- [oss-security] 20140310 Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem exploit mailing-list
- [oss-security] 20140312 Re: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem mailing-list
- web.archive.org
- github.com
- github.com product
- www.vapid.dhs.org exploit