CVE-2007-5379
Moderate severity vulnerability that affects rails
CVE-2007-5379 is a medium vulnerability (CVSS 5.0) in David Hansson Ruby On Rails, published October 19, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.97%, the 90th percentile. Fixed in rails 1.2.4.
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
Exploit likelihood
What each source reports
NVD Score used
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
- Record
CVE-2007-5379- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
- Record
CVE-2007-5379- Updated
- 2026-11-02
EUVDEUVD-2017-0231 No score
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
- Record
EUVD-2017-0231- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fjfg-q662-gm6j No score
Moderate severity vulnerability that affects rails
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
- Record
GHSA-fjfg-q662-gm6j- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
- Record
CVE-2007-5379- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-5379 No score
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
- Record
DEBIAN-CVE-2007-5379- Updated
- 2026-11-02
OSVGHSA-fjfg-q662-gm6j No score
Moderate severity vulnerability that affects rails
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
- Record
GHSA-fjfg-q662-gm6j- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
railsRubyGems |
before 1.2.4 | 1.2.4 |
railsDebian:12 |
before 1.2.5-1 | 1.2.5-1 |
railsDebian:13 |
before 1.2.5-1 | 1.2.5-1 |
railsDebian:14 |
before 1.2.5-1 | 1.2.5-1 |
railsRubyGems |
before 1.2.4, plus listed versions 0.10.00.10.10.11.00.11.10.12.0 Show 28 moreShow less0.12.10.13.00.13.10.14.10.14.20.14.30.14.40.8.00.8.50.9.00.9.10.9.20.9.30.9.40.9.4.10.9.51.0.01.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.21.2.3 |
1.2.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, facts, references, title | GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |
References
vupen.com/english/advisories/2007/4238
us-cert.gov/cas/techalerts/TA07-352A.html
secunia.com/advisories/28136
securityfocus.com/bid/26096
security.gentoo.org/glsa/glsa-200711-17.xml
Show 14 moreShow less
osvdb.org/40717
bugs.gentoo.org/show_bug.cgi?id=195315
weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
docs.info.apple.com/article.html?artnum=307179
dev.rubyonrails.org/ticket/8453
nvd.nist.gov/vuln/detail/CVE-2007-5379
github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-5379.yml
rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
web.archive.org/web/20090602000500/http://dev.rubyonrails.org/ticket/8453
security-tracker.debian.org/tracker/CVE-2007-5379