Name: CVE-2020-8130: Improper Neutralization of Special Elements used in an OS Command
Creator: Rapid7
Published: 2020-02-24T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2020-8130, CWE-78, CVSS 6.4, EPSS 0.00122

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.

CVSS Details

CVSS 3.1 Base Score: 6.4
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Amazon_linux	—	Upgrade rubygem24-rakeUpgrade rubygem-rake	Jul 2, 2020	Feb 24, 2020
Debian	—	Upgrade rake	Feb 28, 2020	Feb 24, 2020
Huawei Euleros 2_0_sp5	—	Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs	Sep 3, 2020	Feb 24, 2020
Huawei Euleros 2_0_sp9	—	Upgrade rubyUpgrade ruby-irbUpgrade ruby-help	Jan 28, 2022	Feb 24, 2020
Suse	—	Upgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5-docUpgrade ruby2.5-doc-ri	Mar 21, 2020	Feb 24, 2020
Ubuntu	—	Upgrade rake	Mar 4, 2020	Feb 24, 2020

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence