CVE-2007-5379
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple)…
Does this matter?
Lower severity and a low EPSS score (3.97%). Track it; it rarely justifies an emergency change on its own.
Description
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 3.97% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- david hansson/ruby on rails
- Source
- cve@mitre.org
References
- http://bugs.gentoo.org/show_bug.cgi?id=195315
- http://dev.rubyonrails.org/ticket/8453
- http://docs.info.apple.com/article.html?artnum=307179
- http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
- http://osvdb.org/40717
- http://secunia.com/advisories/27657
- http://secunia.com/advisories/28136
- http://security.gentoo.org/glsa/glsa-200711-17.xml
- http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
- http://www.securityfocus.com/bid/26096Patch
- http://www.us-cert.gov/cas/techalerts/TA07-352A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/3508
- http://www.vupen.com/english/advisories/2007/4238
- http://bugs.gentoo.org/show_bug.cgi?id=195315
- http://dev.rubyonrails.org/ticket/8453
- http://docs.info.apple.com/article.html?artnum=307179
- http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
- http://osvdb.org/40717
- http://secunia.com/advisories/27657
- http://secunia.com/advisories/28136
- http://security.gentoo.org/glsa/glsa-200711-17.xml
- http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
- http://www.securityfocus.com/bid/26096Patch
- http://www.us-cert.gov/cas/techalerts/TA07-352A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/3508
- http://www.vupen.com/english/advisories/2007/4238
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.