CVE-2007-5379 - Vulnerability Details - OpenCVE

Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.10596.

Key SSVC decision points have not yet been added.

Vendors	Products
David Hansson Subscribe	Ruby On Rails Subscribe

Configuration 1 [-]

cpe:2.3:a:david_hansson:ruby_on_rails:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2017-0231	Moderate severity vulnerability that affects rails
Github GHSA	GHSA-fjfg-q662-gm6j	Moderate severity vulnerability that affects rails

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://bugs.gentoo.org/show_bug.cgi?id=195315
http://dev.rubyonrails.org/ticket/8453
http://docs.info.apple.com/article.html?artnum=307179
http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
http://osvdb.org/40717
http://secunia.com/advisories/27657
http://secunia.com/advisories/28136
http://security.gentoo.org/glsa/glsa-200711-17.xml
http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
http://www.securityfocus.com/bid/26096
http://www.us-cert.gov/cas/techalerts/TA07-352A.html
http://www.vupen.com/english/advisories/2007/3508
http://www.vupen.com/english/advisories/2007/4238

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-10-19T23:00:00

Updated: 2024-08-07T15:31:59.017Z

Reserved: 2007-10-11T00:00:00

Link: CVE-2007-5379

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-10-19T23:17:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-5379

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-200

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-10-05T00:00:00", "descriptions": [{"lang": "en", "value": "Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2007-11-17T10:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "ADV-2007-4238", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/4238"}, {"name": "ADV-2007-3508", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/3508"}, {"name": "TA07-352A", "tags": ["third-party-advisory", "x_refsource_CERT"], "url": "http://www.us-cert.gov/cas/techalerts/TA07-352A.html"}, {"name": "28136", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/28136"}, {"name": "26096", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/26096"}, {"name": "GLSA-200711-17", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://security.gentoo.org/glsa/glsa-200711-17.xml"}, {"name": "40717", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/40717"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugs.gentoo.org/show_bug.cgi?id=195315"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release"}, {"name": "APPLE-SA-2007-12-17", "tags": ["vendor-advisory", "x_refsource_APPLE"], "url": "http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://docs.info.apple.com/article.html?artnum=307179"}, {"name": "27657", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/27657"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://dev.rubyonrails.org/ticket/8453"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2007-5379", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ADV-2007-4238", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/4238"}, {"name": "ADV-2007-3508", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/3508"}, {"name": "TA07-352A", "refsource": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA07-352A.html"}, {"name": "28136", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/28136"}, {"name": "26096", "refsource": "BID", "url": "http://www.securityfocus.com/bid/26096"}, {"name": "GLSA-200711-17", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-200711-17.xml"}, {"name": "40717", "refsource": "OSVDB", "url": "http://osvdb.org/40717"}, {"name": "http://bugs.gentoo.org/show_bug.cgi?id=195315", "refsource": "CONFIRM", "url": "http://bugs.gentoo.org/show_bug.cgi?id=195315"}, {"name": "http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release", "refsource": "CONFIRM", "url": "http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release"}, {"name": "APPLE-SA-2007-12-17", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html"}, {"name": "http://docs.info.apple.com/article.html?artnum=307179", "refsource": "CONFIRM", "url": "http://docs.info.apple.com/article.html?artnum=307179"}, {"name": "27657", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/27657"}, {"name": "http://dev.rubyonrails.org/ticket/8453", "refsource": "CONFIRM", "url": "http://dev.rubyonrails.org/ticket/8453"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T15:31:59.017Z"}, "title": "CVE Program Container", "references": [{"name": "ADV-2007-4238", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/4238"}, {"name": "ADV-2007-3508", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/3508"}, {"name": "TA07-352A", "tags": ["third-party-advisory", "x_refsource_CERT", "x_transferred"], "url": "http://www.us-cert.gov/cas/techalerts/TA07-352A.html"}, {"name": "28136", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/28136"}, {"name": "26096", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/26096"}, {"name": "GLSA-200711-17", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://security.gentoo.org/glsa/glsa-200711-17.xml"}, {"name": "40717", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/40717"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugs.gentoo.org/show_bug.cgi?id=195315"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release"}, {"name": "APPLE-SA-2007-12-17", "tags": ["vendor-advisory", "x_refsource_APPLE", "x_transferred"], "url": "http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://docs.info.apple.com/article.html?artnum=307179"}, {"name": "27657", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/27657"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://dev.rubyonrails.org/ticket/8453"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-5379", "datePublished": "2007-10-19T23:00:00", "dateReserved": "2007-10-11T00:00:00", "dateUpdated": "2024-08-07T15:31:59.017Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:david_hansson:ruby_on_rails:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD060C44-C630-45BD-BFAD-74C8BFFBBD4E", "versionEndIncluding": "1.2.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file."}, {"lang": "es", "value": "El Rails anterior al 1.2.4, como el utilizado en el \"Ruby on Rails\", permite a atacantes remotos y a los servidores ActiveResource determinar la existencia de ficheros de su elecci\u00f3n y leer ficheros XML de su elecci\u00f3n a trav\u00e9s del m\u00e9todo Hash.from_xml (Hash#from_xml), el cual utiliza XmlSimple (XML::Simple) en modo no seguro, como lo demostrado leyendo las contrase\u00f1as del fichero Pidgin (Gaim) .purple/accounts.xml."}], "id": "CVE-2007-5379", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-10-19T23:17:00.000", "references": [{"source": "[email protected]", "url": "http://bugs.gentoo.org/show_bug.cgi?id=195315"}, {"source": "[email protected]", "url": "http://dev.rubyonrails.org/ticket/8453"}, {"source": "[email protected]", "url": "http://docs.info.apple.com/article.html?artnum=307179"}, {"source": "[email protected]", "url": "http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html"}, {"source": "[email protected]", "url": "http://osvdb.org/40717"}, {"source": "[email protected]", "url": "http://secunia.com/advisories/27657"}, {"source": "[email protected]", "url": "http://secunia.com/advisories/28136"}, {"source": "[email protected]", "url": "http://security.gentoo.org/glsa/glsa-200711-17.xml"}, {"source": "[email protected]", "url": "http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release"}, {"source": "[email protected]", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/26096"}, {"source": "[email protected]", "tags": ["US Government Resource"], "url": "http://www.us-cert.gov/cas/techalerts/TA07-352A.html"}, {"source": "[email protected]", "url": "http://www.vupen.com/english/advisories/2007/3508"}, {"source": "[email protected]", "url": "http://www.vupen.com/english/advisories/2007/4238"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://bugs.gentoo.org/show_bug.cgi?id=195315"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://dev.rubyonrails.org/ticket/8453"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://docs.info.apple.com/article.html?artnum=307179"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/40717"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/27657"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/28136"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://security.gentoo.org/glsa/glsa-200711-17.xml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.securityfocus.com/bid/26096"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://www.us-cert.gov/cas/techalerts/TA07-352A.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/3508"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/4238"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "[email protected]", "type": "Primary"}]}