GHSA-m6f7-46hw-grcjCritical

Creme Fraiche contains OS Command Injection

Published
October 24, 2017
Last Modified
November 6, 2023

🔗 CVE IDs covered (1)

CVE-2013-2090 →

📋 Description

The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment. NOTE: some of these details are obtained from third party information.

🎯 Affected products1

  • rubygems/cremefraiche:< 0.6.1

🔗 References (4)