CVE-2019-3881
High
Description
Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.
SeverityHigh
CVSS7.8
Exploit probability—
ProductBundler
PublishedSep 4, 2020
First seenSep 4, 2020
Weakness typeCWE-427CWE-427
How to fix
Update
- bundler bundler2.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bundler bundler | v < 2.1.0 | 2.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.