lean-ruport allows local users to obtain sensitive information by listing the process

ALTO 7.8CVE-2014-4998 · GHSA-5g7f-p7jg-v6mv · Published 10/01/2018 · updated 17/06/2026

In breve

CVE-2014-4998 è una vulnerabilità ALTO (CVSS 7.8) che riguarda lean-ruport, lean-ruport (lean-ruport project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.52%, superiore al 44.5% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
lean-ruport RubyGems	`≤ 0.3.8`	No fix yet
lean-ruport lean-ruport_project	`= 0.3.8`	No fix yet

Description

test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.

NVD description

test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.

References

nvd.nist.gov/vuln/detail/CVE-2014-4998 · ADVISORY
openwall.com/lists/oss-security/2014/07/07/18 · WEB
openwall.com/lists/oss-security/2014/07/17/5 · WEB
vapid.dhs.org/advisories/lean-ruport-0.3.8.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free