xaviershay-dm-rails v0.10.3.8 mysql credential exposure
CVE ID(s):
CVE-2015-2179
Notified: 2015-02-17
Description:
This gem provides the railtie that allows datamapper to hook into rails3 and thus behave like a rails framework component. Just like activerecord does in rails, dm-rails uses the railtie API to hook into rails. The two are actually hooked into rails almost identically.
Exploit:
$ while (true) do ps -ef |grep [p]assword; done
Notes:
118579