-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe core vulnerability stems from insecure temporary file handling in lib/vlad/dba/mysql.rb. The setup_dot_my_cnf task uses File.open to write sensitive data to a predictable /tmp/my.cnf.#{target_host} path, allowing attackers to create symlinks before file creation. The remove_dot_my_cnf task's use of a raw rm command on the same predictable path adds secondary risk. Both patterns are classic examples of CWE-59 (Improper Link Resolution), with high confidence for the write operation and medium confidence for the deletion due to its secondary role.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| VladTheEnterprising | rubygems | <= 0.2 |