CVE-2007-5379 Moderate severity vulnerability that affects rails
Remote attackers can read arbitrary XML files and determine file existence via unsafe XML parsing in Ruby on Rails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-5379?
CVE-2007-5379 is a medium-severity vulnerability in n/a, published on 19 Oct 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
Weakness: CWE-200
Which versions are affected by CVE-2007-5379?
2 open source packages ship an affected version, including rails. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rails RubyGems | All versions | 1.2.4 |
rails RubyGems | All versions | 1.2.4 |
Products include David Hansson Ruby on Rails.
How do I fix CVE-2007-5379?
Upgrade rails to 1.2.4 or later.
Is CVE-2007-5379 being exploited?
There is no known exploitation of CVE-2007-5379 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2007-5379, GHSA-fjfg-q662-gm6j.