CVE-2014-1835 — Vulnerability in echor — CVE Details
HIGH
Echor Ruby Gem credentials can be stolen via process table monitoring
Published May 14, 2022Updated December 4, 2024Source: osv
Summary
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table.
Advisory Timeline
- First published May 14, 2022 (1612 days ago).
- Last revised December 4, 2024 — 935 days after initial publication.
Affected Packages (1)
Affects 1 ecosystem: rubygems (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| echor | rubygems | 0.1.4, 0.1.5, 0.1.6 | Range-based data available |
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 7.8 score means for each attack dimension.
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Frequently Asked Questions
- What is CVE-2014-1835?
- Echor Ruby Gem credentials can be stolen via process table monitoring This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.8/10).
- How do I check if my project is affected by CVE-2014-1835?
- CVE-2014-1835 affects echor. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2014-1835 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
7.8
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-j4gx-p3x5-m987
Related CVEs
- CVE-2026-94462HIGH
Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
- CVE-2014-1834HIGH
Echor contains Command Injection
- CVE-2026-77601HIGH
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies