safemode gem allows context-dependent attackers to obtain sensitive information via the inspect method

Also known as GHSA-c92m-rrrc-q5wf

Published 10 y ago 2016-05-20 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

2.1%

percentile 82%

Public exploits

none known

The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.

Exploit prediction (EPSS)

2.13% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.1	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`
GitHub	3.0	8.1	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
rubygems	`safemode`	<1.2.4	1.2.4

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-264 Permissions, Privileges, and Access Controls

References

github.com /theforeman/foreman/commit/82f9b93c54f72c5814df6bab7fad057eab65b2f2 · x_refsource_CONFIRM, x_transferred
theforeman.org /security.html#2016-3693 · x_refsource_CONFIRM, x_transferred
access.redhat.com /errata/RHSA-2018:0336 · vendor-advisory, x_refsource_REDHAT, x_transferred
openwall.com /lists/oss-security/2016/04/20/8 · mailing-list, x_refsource_MLIST, x_transferred
rubysec.com /advisories/CVE-2016-3693/ · x_refsource_CONFIRM, x_transferred
github.com /svenfuchs/safemode/commit/0f764a1720a3a68fd2842e21377c8bfad6d7126f · x_refsource_CONFIRM, x_transferred
projects.theforeman.org /issues/14635 · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-3693 · advisory
github.com /svenfuchs/safemode · package
rubysec.com /advisories/CVE-2016-3693 · web

Sources

CVE List: CVE-2016-3693
GitHub Advisory: GHSA-c92m-rrrc-q5wf
NVD: CVE-2016-3693

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.