7.8
CVE-2014-4999
- EPSS 0.05%
- Veröffentlicht 10.01.2018 18:29:00
- Zuletzt bearbeitet 21.11.2024 02:11:14
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
Loginvendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in the capture function and (2) mysql command line in the restore function, which allows local users to obtain sensitive information by listing the process.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Kajam Project ≫ Kajam Version1.0.3 Updaterc2 SwPlatformruby
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.05% | 0.136 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.8 | 1.8 | 5.9 |
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 2.1 | 3.9 | 2.9 |
AV:L/AC:L/Au:N/C:P/I:N/A:N
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.