CVE-2014-4994 Gyazo allows local users to write arbitrary files
MediumCVSS 5.5
EPSS 0.48%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems gyazo(RubyGems) | = 1.0.0 | No fix listed |
| rubygems gyazo(RubyGems) | >= 1.0.0, < 2.0.0 | 2.0.0 |
| gyazo project gyazo | = 1.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- [oss-security] 20140707 Vulnerability Report for Ruby Gem gyazo-1.0.0 mailing-list third-party-advisory
- [oss-security] 20140717 Re: Vulnerability Report for Ruby Gem codders-dataset-1.3.2.1 (etc.) mailing-list third-party-advisory
- github.com exploit
- web.archive.org
- github.com
- github.com product
- www.vapid.dhs.org exploit third-party-advisory