CVE-2007-5379: Infoleak
Published Oct 19, 2007
·Updated
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.fromxml (Hash#fromxml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
Affected Software
2 affected componentsFixes available
David Hansson Ruby On Rails<=1.2.3
rubygems/rails<1.2.4
1.2.4
Remediation
Patch Available
Event History
Oct 19, 2007
CVE Published
11:17 PM
Oct 20, 2007
CVE Published
via MITRE·03:00 AM
Data Sourced
via MITRE·03:00 AM
Description
Oct 24, 2017
Advisory Published
via GitHub·06:33 PM
Frequently Asked Questions
1
What is the severity of CVE-2007-5379?
CVE-2007-5379 has a medium severity rating, as it allows attackers to read arbitrary XML files remotely.
2
How do I fix CVE-2007-5379?
To fix CVE-2007-5379, upgrade Rails to version 1.2.5 or later.
3
What versions of Rails are affected by CVE-2007-5379?
CVE-2007-5379 affects Rails versions before 1.2.4.
4
Can CVE-2007-5379 be exploited remotely?
Yes, CVE-2007-5379 can be exploited remotely by attackers to gain access to sensitive files.
5
What method in Rails is vulnerable in CVE-2007-5379?
The vulnerability in CVE-2007-5379 is due to the unsafe use of the Hash.from_xml method.