CVE-2013-2516: Command Injection
First published: Fri Feb 15 2019(Updated: )
Ruby Gem Fileutils prior to v0.7.1 contains a Command Injection vulnerability in user supplied url variable that is passed to the shell.
Credit: larry0@me.com larry0@me.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| rubygems/fileutils | <0.7.1 | 0.7.1 |
| Fileutils project Fileutils Ruby | <=0.7 | |
| GNU Fileutils | <=0.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2013-2516
- http://rubygems.org/gems/fileutils
- http://www.vapidlabs.com/advisory.php?v=36
- https://github.com/ruby/fileutils/commit/994c7aa1ba391689f844a069b9aee9e49813686c
- https://bugs.ruby-lang.org/issues/7958
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fileutils/CVE-2013-2516.yml
- https://github.com/advisories/GHSA-9x97-x2p9-hvpf (Advisory)
Frequently Asked Questions
What is the severity of CVE-2013-2516?
CVE-2013-2516 has a moderate severity level due to its potential for command injection.
How do I fix CVE-2013-2516?
To fix CVE-2013-2516, update the Fileutils Ruby Gem to version 0.7.1 or higher.
What types of systems are affected by CVE-2013-2516?
CVE-2013-2516 affects systems using Fileutils Ruby Gem versions 0.7 or lower.
Can CVE-2013-2516 be exploited remotely?
Yes, CVE-2013-2516 can be exploited remotely if the vulnerable Fileutils version is used in a web application.
What is the impact of CVE-2013-2516?
The impact of CVE-2013-2516 includes unauthorized command execution on the system where the vulnerable gem is used.
- collector/github-advisory-latest
- alias/GHSA-9x97-x2p9-hvpf
- alias/CVE-2013-2516
- collector/github-advisory
- agent/author
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/rubygems
- vendor/fileutils project
- canonical/fileutils project fileutils ruby
- version/fileutils project fileutils ruby/0.7
- canonical/gnu fileutils
- version/gnu fileutils/0.7