CVE-2013-1933: OS Command Injection
The extractfromocr function in lib/docsplit/textextractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.
Other sources
The extractfromocr function in lib/docsplit/textextractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1933?
CVE-2013-1933 has a medium severity level due to its potential for command injection attacks.
How do I fix CVE-2013-1933?
To fix CVE-2013-1933, upgrade the Karteek Docsplit gem to a later version than 0.5.4.
What allows the vulnerability in CVE-2013-1933 to occur?
The vulnerability occurs due to lack of proper sanitization of PDF filenames in the extract_from_ocr function.
Who is affected by CVE-2013-1933?
Users of the Karteek Docsplit gem version 0.5.4 for Ruby are affected by CVE-2013-1933.
What kind of attack can be executed using CVE-2013-1933?
CVE-2013-1933 allows attackers to execute arbitrary commands via shell metacharacters in a PDF filename.