CVE-2019-18409

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, a local user can insert malicious code into the ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/zenspider/ruby_parser-legacy/issues/1Exploit, Issue Tracking, Third Party Advisory
https://github.com/zenspider/ruby_parser-legacy/issues/1Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Oct 24, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-18418.1A vulnerability in the Software Image Management feature of Cisco DNA Center could allow an authenticated, remote attacker to access to inte CVE-2019-184118.8Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vuln CVE-2019-184127.5JetBrains IDETalk plugin before version 193.4099.10 allows XXE CVE-2019-184139.8In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via CVE-2019-184148.8Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lac CVE-2019-184156.1Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen.CVE-2019-184166.1Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member.CVE-2019-184178.8Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code execution CVE-2019-184189.8clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no se CVE-2019-184196.1A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web sc CVE-2019-18425.4A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to CVE-2019-184206.5An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall.