Vulnerabilities > CVE-2014-5002 - Credentials Management vulnerability in Lynx Project Lynx

CVSS 7.8 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

lynx-project

CWE-255

NVD

Published: 2018-01-10

Updated: 2024-11-21

Summary

The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.

Vulnerable Configurations

Part	Description	Count
Application	Lynx_Project Lynx Project Lynx 0.0.1 Lynx Project Lynx 0.0.2 Lynx Project Lynx 0.1.0 Lynx Project Lynx 0.2.0 Lynx Project Lynx 0.2.1 Lynx Project Lynx 0.3.0 Lynx Project Lynx 0.4.0	7

Common Weakness Enumeration (CWE)

CWE-255 - Credentials Management

References

http://www.openwall.com/lists/oss-security/2014/07/07/23
http://www.openwall.com/lists/oss-security/2014/07/07/23
http://www.openwall.com/lists/oss-security/2014/07/17/5
http://www.openwall.com/lists/oss-security/2014/07/17/5
http://www.vapid.dhs.org/advisories/lynx-0.2.0.html
http://www.vapid.dhs.org/advisories/lynx-0.2.0.html
https://github.com/panthomakos/lynx/issues/3
https://github.com/panthomakos/lynx/issues/3