CVE-2013-1875: Code Injection
Published Mar 20, 2013
·Updated
commandwrap.rb in the commandwrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename.
Affected Software
2 affected components
Rubygems Command Wrap
rubygems/command_wrap<=0.6.2
Event History
Mar 20, 2013
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Oct 24, 2017
Advisory Published
06:33 PM
Frequently Asked Questions
1
What is the severity of CVE-2013-1875?
CVE-2013-1875 is considered a critical vulnerability due to its potential for remote command execution.
2
How do I fix CVE-2013-1875?
The fix for CVE-2013-1875 involves upgrading the command_wrap Gem to version 0.6.3 or later.
3
Who is affected by CVE-2013-1875?
CVE-2013-1875 affects all applications using the command_wrap Gem up to version 0.6.2.
4
What types of attacks can exploit CVE-2013-1875?
Attackers can exploit CVE-2013-1875 to execute arbitrary commands on the server by manipulating URLs or filenames.
5
Is there a workaround for CVE-2013-1875?
A temporary workaround for CVE-2013-1875 includes sanitizing input to remove shell metacharacters to prevent command execution.