Description

The FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, 1.8.8dev, 1.9.1 through 1.9.1-430, 1.9.2 through 1.9.2-136, and 1.9.3dev allows local users to delete arbitrary files via a symlink attack.

Remediation

References

CVE-2011-1004

Related Vulnerabilities

WordPress Plugin Quiz and Survey Master (QSM)-Easy Quiz and Survey Maker SQL Injection (7.3.4)

WordPress Plugin Twitget Cross-Site Request Forgery (3.3.2)

Ruby Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-0256)

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-19217)

WordPress Plugin The Official Facebook Chat Cross-Site Request Forgery (1.2)

Severity

Medium

Classification

CVE-2011-1004 CWE-59

Tags

Missing Update Known Vulnerabilities