lean-ruport allows local users to obtain sensitive information by listing the process

HOCH 7.8CVE-2014-4998 · GHSA-5g7f-p7jg-v6mv · Published 10/01/2018 · updated 17/06/2026

Kurz gesagt

CVE-2014-4998 ist eine Schwachstelle (HOCH (CVSS 7.8)) in lean-ruport, lean-ruport (lean-ruport project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.52%, höher als bei 44.5% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
lean-ruport RubyGems	`≤ 0.3.8`	No fix yet
lean-ruport lean-ruport_project	`= 0.3.8`	No fix yet

Description

test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.

NVD description

test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.

References

nvd.nist.gov/vuln/detail/CVE-2014-4998 · ADVISORY
openwall.com/lists/oss-security/2014/07/07/18 · WEB
openwall.com/lists/oss-security/2014/07/17/5 · WEB
vapid.dhs.org/advisories/lean-ruport-0.3.8.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free