CVE-2007-5379

Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read…

published October 19, 2007

CVSS
—
EPSS
4%
Percentile
90.4
In the wild
Unconfirmed
What it is

Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03969 · 90.4th percentile
Published
2007-10-19T23:00Z
EPSS history
Timeline
  • 19 OCT 23:00Z
    Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read…
    cvelistv5