Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Ruby Improper Control of Generation of Code (Code Injection) Vulnerability - CVE-2019-16255 - Vulnerability Database
Ruby

Ruby Improper Control of Generation of Code (Code Injection) Vulnerability - CVE-2019-16255

High
Reference: CVE-2019-16255
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2019-16255
Title: Ruby Improper Control of Generation of Code (Code Injection) Vulnerability
Overview:

Ruby through 2.4.7 2.5.x through 2.5.6 and 2.6.x through 2.6.4 allows code injection if the first argument (aka the quotcommandquot argument) to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.