CVE-2013-2616: Code Injection

Q: What is the severity of CVE-2013-2616?

CVE-2013-2616 has a severity rating that indicates a high risk of arbitrary command execution if exploited.

Q: How do I fix CVE-2013-2616?

To fix CVE-2013-2616, upgrade the MiniMagick Gem to version 3.6.0 or later.

Q: Who is affected by CVE-2013-2616?

CVE-2013-2616 affects users of the MiniMagick Gem versions 1.3.1 and below.

Q: What are the potential impacts of CVE-2013-2616?

The potential impacts of CVE-2013-2616 include unauthorized remote command execution on the server.

Q: Is CVE-2013-2616 a common vulnerability?

CVE-2013-2616 is relatively common among applications that utilize the affected version of the MiniMagick Gem.

Published Mar 20, 2013

Updated

lib/minimagick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.

Other sources

lib/minimagick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.

Affected Software

2 affected componentsFixes available

rubygems/mini_magick<3.6.0

3.6.0

Rubygems Mini Magick=1.3.1

Event History

Mar 20, 2013

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Oct 24, 2017

Advisory Published

06:33 PM

Frequently Asked Questions

What is the severity of CVE-2013-2616?

CVE-2013-2616 has a severity rating that indicates a high risk of arbitrary command execution if exploited.

How do I fix CVE-2013-2616?

To fix CVE-2013-2616, upgrade the MiniMagick Gem to version 3.6.0 or later.

Who is affected by CVE-2013-2616?

CVE-2013-2616 affects users of the MiniMagick Gem versions 1.3.1 and below.

What are the potential impacts of CVE-2013-2616?