CVE-2020-8130 is an OS command injection vulnerability in Ruby Rake versions prior to 12.3.3, specifically within the Rake::FileList component when processing filenames starting with a pipe character. This vulnerability has a CVSS score of 6.4 (Medium), indicating a high impact on confidentiality, integrity, and availability, but requires high privileges and local access to exploit. Despite its potential impact, there is no evidence of active exploitation, no publicly available exploit code in common databases like Metasploit or ExploitDB, and minimal community discussion or media coverage, with only one article mentioning it in the context of a GitLab security release.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 12.3.3CPE matchmatch criteria | cpe:2.3:a:ruby-lang:rake:*:*:*:*:*:*:*:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | ||
18.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | ||
19.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
OS Command Injection in Rake
Feb 28, 2020There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
Feb 11, 2020rake: OS Command Injection via egrep in Rake::FileList
Aug 29, 2019