CVE-2007-5379 json
Moderate severity vulnerability that affects rails
published 2007-10-19 19 y ago modified 2026-06-16 4 mo ago also GHSA-fjfg-q662-gm6j , EUVD-2017-0231
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.0%
- EPSS 4.0% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
Patch / fix
- rubygems rails 1.2.4
- rails Debian 14, Debian 13, Debian 12 1.2.5-1
debian advisories DEBIAN-CVE-2007-5379
Exploit prediction
3.97% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | rails | <1.2.4 |
1.2.4 |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- Technology feeds
References
-
securityfocus.com
/bid/26096
vdb-entry, patch
-
security.gentoo.org
/glsa/glsa-200711-17.xml
vendor-advisory, web
-
lists.apple.com
/archives/security-announce/2007/Dec/msg00002.html
vendor-advisory, web
-
vupen.com
/english/advisories/2007/4238
vdb-entry, web
-
vupen.com
/english/advisories/2007/3508
vdb-entry, web
-
us-cert.gov
/cas/techalerts/TA07-352A.html
third-party-advisory, web, us-government-resource
-
secunia.com
/advisories/28136
third-party-advisory
-
osvdb.org
/40717
vdb-entry
-
bugs.gentoo.org
/show_bug.cgi?id=195315
web
- weblog.rubyonrails.org /2007/10/5/rails-1-2-4-maintenance-release
-
docs.info.apple.com
/article.html?artnum=307179
web
-
secunia.com
/advisories/27657
third-party-advisory
- dev.rubyonrails.org /ticket/8453
-
nvd.nist.gov
/vuln/detail/CVE-2007-5379
advisory
-
github.com
/rails/rails
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-5379.yml
web
-
rubyonrails.org
/2007/10/5/rails-1-2-4-maintenance-release
web
-
web.archive.org
/web/20090602000500/http://dev.rubyonrails.org/ticket/8453
web
Sources
- CVE List CVE-2007-5379
- GitHub Advisory GHSA-fjfg-q662-gm6j
- NVD CVE-2007-5379
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.