Description
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
References (5)
Core 5
Core References
Mailing List x_refsource_confirm
https://groups.google.com/forum/?fromgroups=#%21topic/dragonfly-users/3c3WIU3VQTo
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/82476
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/58225
Vendor Advisory x_refsource_confirm
https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/52380
Scores
EPSS
0.0198
EPSS Percentile
83.7%
Details
CWE
CWE-94
Status
published
Products (27)
mark_evans/dragonfly_gem
0.7.0
mark_evans/dragonfly_gem
0.7.1
mark_evans/dragonfly_gem
0.7.2
mark_evans/dragonfly_gem
0.7.3
mark_evans/dragonfly_gem
0.7.4
mark_evans/dragonfly_gem
0.7.5
mark_evans/dragonfly_gem
0.7.6
mark_evans/dragonfly_gem
0.7.7
mark_evans/dragonfly_gem
0.8.0
mark_evans/dragonfly_gem
0.8.1
... and 17 more
Published
Jun 09, 2014
Tracked Since
Feb 18, 2026