Information disclosure in Basespace Ruby Sdk Project

CVE-2013-7111

The put_call function in the API client (api/api_client.rb) in the BaseSpace Ruby SDK (aka bio-basespace-sdk) gem 0.1.7 for Ruby uses the API_KEY on the command line, which allows remote attackers to obtain sensitive information by listing the processes.

Vulnerability class: Information Disclosure

EPSS: 0.015 (71.8th percentile) — read the EPSS interpretation.

Affected products

Basespace_ruby_sdk_project Basespace_ruby_sdk — versions 0.1.7
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (x_refsource_MISC)
cve@mitre.org (mailing-list, x_refsource_MLIST, Exploit)
cve@mitre.org (mailing-list, x_refsource_MLIST)