« Volver al listado

CVE-2013-4457

Estado: ModificadaMedia (6.8)—

The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Thoughtbot — Cocaine

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-4457",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-11-02T18:55:03.203",
  "references": [
    {
      "url": "http://osvdb.org/98835",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/55365",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2013/10/22/10",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/thoughtbot/cocaine/blob/master/NEWS.md",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://osvdb.org/98835",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/55365",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2013/10/22/10",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/thoughtbot/cocaine/blob/master/NEWS.md",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation."
    },
    {
      "lang": "es",
      "value": "The Cocaine gem 0.5.2 hasta la versión 0.4.0 para Ruby permite a atacantes dependientes del contexto ejecutar comandos arbitrarios a través de un objetomanipulado, en relación con una interpolación variable recursiva."
    }
  ],
  "lastModified": "2026-06-16T23:57:15.733",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:thoughtbot:cocaine:0.4.0:-:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0A3F112-7C8C-452B-B575-086CC85C66A8"
            },
            {
              "criteria": "cpe:2.3:a:thoughtbot:cocaine:0.4.1:-:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3B7D3FF-A2DF-4D5F-AEDE-652CAF37DEE6"
            },
            {
              "criteria": "cpe:2.3:a:thoughtbot:cocaine:0.4.2:-:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C672466B-D327-48B5-8104-2988733A7EC3"
            },
            {
              "criteria": "cpe:2.3:a:thoughtbot:cocaine:0.5.0:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "043EF947-A38D-4622-86EE-D1A77729578C"
            },
            {
              "criteria": "cpe:2.3:a:thoughtbot:cocaine:0.5.1:-:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79A123CF-DBCB-49C2-B581-6B50E3F211F5"
            },
            {
              "criteria": "cpe:2.3:a:thoughtbot:cocaine:0.5.2:-:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67BABC98-3058-4741-8B12-3F8A5830E240"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}