CVE-2013-4478
Sup Code Injection vulnerability
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
Exploit likelihood
What each source reports
NVD Score used
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
- Record
CVE-2013-4478- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
- Record
CVE-2013-4478- Updated
- 2026-11-02
EUVDEUVD-2022-2570 No score
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
- Record
EUVD-2022-2570- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5f2p-6vjv-2q2m No score
Sup Code Injection vulnerability
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
- Record
GHSA-5f2p-6vjv-2q2m- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
- Record
CVE-2013-4478- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4478 No score
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
- Record
DEBIAN-CVE-2013-4478- Updated
- 2026-11-02
OSVGHSA-5f2p-6vjv-2q2m No score
Sup Code Injection vulnerability
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
- Record
GHSA-5f2p-6vjv-2q2m- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4478 No score
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
- Record
UBUNTU-CVE-2013-4478- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
supRubyGems |
before 0.13.2.1 | 0.13.2.1 |
supRubyGems |
0.14.0 up to 0.14.1.1 | 0.14.1.1 |
sup-mailDebian:12 |
before 0.12.1+git20120407.aaa852f-1+deb7u1 | 0.12.1+git20120407.aaa852f-1+deb7u1 |
sup-mailDebian:13 |
before 0.12.1+git20120407.aaa852f-1+deb7u1 | 0.12.1+git20120407.aaa852f-1+deb7u1 |
sup-mailDebian:14 |
before 0.12.1+git20120407.aaa852f-1+deb7u1 | 0.12.1+git20120407.aaa852f-1+deb7u1 |
sup-mailDebian:6.0 From an advisory covering 2 CVEs |
before 0.11-2+nmu1+deb6u1, plus listed versions 0.11-2 |
0.11-2+nmu1+deb6u1 |
sup-mailDebian:7 From an advisory covering 2 CVEs |
before 0.12.1+git20120407.aaa852f-1+deb7u1, plus listed versions 0.12.1+git20120407.aaa852f-1 |
0.12.1+git20120407.aaa852f-1+deb7u1 |
supRubyGems |
before 0.13.2.1, plus listed versions 0.0.10.0.20.0.30.0.40.0.5 Show 23 moreShow less0.0.60.0.70.0.80.10.100.10.10.10.20.110.120.12.10.13.00.13.10.13.20.20.30.40.50.60.70.80.8.10.90.9.1 |
0.13.2.1 |
supRubyGems |
0.14.0 up to 0.14.1.1, plus listed versions 0.14.1 |
0.14.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4478 is a medium vulnerability (CVSS 6.8) in Supmua Sup, published November 27, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. Fixed in sup 0.13.2.1.
References
rubyforge.org/pipermail/sup-talk/2013-August/004993.html
secunia.com/advisories/55294
debian.org/security/2012/dsa-2805
github.com/sup-heliotrope/sup/commit/8b46cdbfc14e07ca07d403aa28b0e7bc1c544785
Show 11 moreShow less
openwall.com/lists/oss-security/2013/10/30/2
nvd.nist.gov/vuln/detail/CVE-2013-4478
web.archive.org/web/20140524005344/http://rubyforge.org/pipermail/sup-talk/2013-October/004996.html
phenoelit.org/stuff/whatsup.txt
security-tracker.debian.org/tracker/CVE-2013-4478
ubuntu.com/security/CVE-2013-4478
cve.org/CVERecord?id=CVE-2013-4478