Description

The FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, 1.8.8dev, 1.9.1 through 1.9.1-430, 1.9.2 through 1.9.2-136, and 1.9.3dev allows local users to delete arbitrary files via a symlink attack.

Remediation

References

CVE-2011-1004

Related Vulnerabilities

WordPress Plugin Metform Elementor Contact Form Builder-Flexible and Design-Friendly Contact Form builder for WordPress Information Disclosure (2.1.3)

WordPress Plugin Photospace Gallery Cross-Site Scripting (2.3.5)

WordPress Plugin File Away Multiple Unspecified Vulnerabilities (3.8.4)

Django Improper Certificate Validation Vulnerability (CVE-2020-13254)

PHP Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2006-5178)

Severity

Medium

Classification

CVE-2011-1004 CWE-59

Tags

Missing Update Known Vulnerabilities