Published: 23/02/2023 Updated: 21/11/2024

pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3.

Vulnerable Product	Search on Vulmon	Subscribe to Product
newspaperclub pdf info 0.5.3

pdf_info <= 0.5.3 OS Command Injection

CVE-2022-36231 The ruby gem pdf_info <= 053 is vulnerable to OS Command Injection when executing a method on a PDF::Info object An attacker using a specially crafted payload may execute OS commands by using command chaining Vulnerability Analysis When creating a new PDF::Info object the initialize command is called def initialize(pdf_path) @pdf_path = pdf_path end

NVD-CWE-noinfo https://nvd.nist.gov https://github.com/affix/CVE-2022-36231 https://www.first.org/epss https://github.com/affix/CVE-2022-36231 https://github.com/newspaperclub/pdf_info/issues/16 https://github.com/newspaperclub/pdf_info/pull/15 https://rubygems.org/gems/pdf_info https://github.com/affix/CVE-2022-36231 https://github.com/newspaperclub/pdf_info/issues/16 https://github.com/newspaperclub/pdf_info/pull/15 https://rubygems.org/gems/pdf_info

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2022-36231

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect