Read the docs
TI-2014-02319 Aliases CVE-2014-2888GHSA-vm28-mrm7-fpjq

lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers…

Priority LOW 37CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request.

Why it matters now

EPSS 0.02188 82nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed sfpagent (RubyGems): 0.4.15

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—sfpagent (RubyGems)before 0.4.150.4.15Patch availableGHSA-vm28-mrm7-fpjq
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • sfpagent (RubyGems) Vendor— Affected before 0.4.15 Fixed in 0.4.15 Patch available GHSA-vm28-mrm7-fpjq

CPE configurations NVD · 53

CPEVersionsRoleVendor
cpe:2.3:a:herry:sfpagent:*:*:*:*:*:ruby:*:*up to 0.4.14VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.0.1:*:*:*:*:ruby:*:*0.0.1VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.0:*:*:*:*:ruby:*:*0.1.0VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.1:*:*:*:*:ruby:*:*0.1.1VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.2:*:*:*:*:ruby:*:*0.1.2VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.3:*:*:*:*:ruby:*:*0.1.3VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.4:*:*:*:*:ruby:*:*0.1.4VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.5:*:*:*:*:ruby:*:*0.1.5VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.6:*:*:*:*:ruby:*:*0.1.6VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.7:*:*:*:*:ruby:*:*0.1.7VulnerableHerry
  • cpe:2.3:a:herry:sfpagent:*:*:*:*:*:ruby:*:* Versions up to 0.4.14 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.0.1:*:*:*:*:ruby:*:* Versions 0.0.1 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.0:*:*:*:*:ruby:*:* Versions 0.1.0 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.1:*:*:*:*:ruby:*:* Versions 0.1.1 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.2:*:*:*:*:ruby:*:* Versions 0.1.2 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.3:*:*:*:*:ruby:*:* Versions 0.1.3 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.4:*:*:*:*:ruby:*:* Versions 0.1.4 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.5:*:*:*:*:ruby:*:* Versions 0.1.5 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.6:*:*:*:*:ruby:*:* Versions 0.1.6 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.7:*:*:*:*:ruby:*:* Versions 0.1.7 Vulnerable ·Herry
Show 43 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:herry:sfpagent:0.1.8:*:*:*:*:ruby:*:*0.1.8VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.9:*:*:*:*:ruby:*:*0.1.9VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.10:*:*:*:*:ruby:*:*0.1.10VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.11:*:*:*:*:ruby:*:*0.1.11VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.12:*:*:*:*:ruby:*:*0.1.12VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.13:*:*:*:*:ruby:*:*0.1.13VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.1.14:*:*:*:*:ruby:*:*0.1.14VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.2.0:*:*:*:*:ruby:*:*0.2.0VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.2.1:*:*:*:*:ruby:*:*0.2.1VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.2.2:*:*:*:*:ruby:*:*0.2.2VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.2.3:*:*:*:*:ruby:*:*0.2.3VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.2.4:*:*:*:*:ruby:*:*0.2.4VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.2.5:*:*:*:*:ruby:*:*0.2.5VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.2.6:*:*:*:*:ruby:*:*0.2.6VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.2.7:*:*:*:*:ruby:*:*0.2.7VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.2.8:*:*:*:*:ruby:*:*0.2.8VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.2.9:*:*:*:*:ruby:*:*0.2.9VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.2.10:*:*:*:*:ruby:*:*0.2.10VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.3.0:*:*:*:*:ruby:*:*0.3.0VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.3.1:*:*:*:*:ruby:*:*0.3.1VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.3.2:*:*:*:*:ruby:*:*0.3.2VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.3.3:*:*:*:*:ruby:*:*0.3.3VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.3.4:*:*:*:*:ruby:*:*0.3.4VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.3.5:*:*:*:*:ruby:*:*0.3.5VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.3.6:*:*:*:*:ruby:*:*0.3.6VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.3.7:*:*:*:*:ruby:*:*0.3.7VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.3.8:*:*:*:*:ruby:*:*0.3.8VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.3.9:*:*:*:*:ruby:*:*0.3.9VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.3.10:*:*:*:*:ruby:*:*0.3.10VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.0:*:*:*:*:ruby:*:*0.4.0VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.1:*:*:*:*:ruby:*:*0.4.1VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.2:*:*:*:*:ruby:*:*0.4.2VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.3:*:*:*:*:ruby:*:*0.4.3VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.4:*:*:*:*:ruby:*:*0.4.4VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.5:*:*:*:*:ruby:*:*0.4.5VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.6:*:*:*:*:ruby:*:*0.4.6VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.7:*:*:*:*:ruby:*:*0.4.7VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.8:*:*:*:*:ruby:*:*0.4.8VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.9:*:*:*:*:ruby:*:*0.4.9VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.10:*:*:*:*:ruby:*:*0.4.10VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.11:*:*:*:*:ruby:*:*0.4.11VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.12:*:*:*:*:ruby:*:*0.4.12VulnerableHerry
cpe:2.3:a:herry:sfpagent:0.4.13:*:*:*:*:ruby:*:*0.4.13VulnerableHerry
  • cpe:2.3:a:herry:sfpagent:0.1.8:*:*:*:*:ruby:*:* Versions 0.1.8 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.9:*:*:*:*:ruby:*:* Versions 0.1.9 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.10:*:*:*:*:ruby:*:* Versions 0.1.10 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.11:*:*:*:*:ruby:*:* Versions 0.1.11 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.12:*:*:*:*:ruby:*:* Versions 0.1.12 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.13:*:*:*:*:ruby:*:* Versions 0.1.13 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.1.14:*:*:*:*:ruby:*:* Versions 0.1.14 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.2.0:*:*:*:*:ruby:*:* Versions 0.2.0 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.2.1:*:*:*:*:ruby:*:* Versions 0.2.1 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.2.2:*:*:*:*:ruby:*:* Versions 0.2.2 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.2.3:*:*:*:*:ruby:*:* Versions 0.2.3 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.2.4:*:*:*:*:ruby:*:* Versions 0.2.4 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.2.5:*:*:*:*:ruby:*:* Versions 0.2.5 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.2.6:*:*:*:*:ruby:*:* Versions 0.2.6 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.2.7:*:*:*:*:ruby:*:* Versions 0.2.7 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.2.8:*:*:*:*:ruby:*:* Versions 0.2.8 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.2.9:*:*:*:*:ruby:*:* Versions 0.2.9 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.2.10:*:*:*:*:ruby:*:* Versions 0.2.10 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.3.0:*:*:*:*:ruby:*:* Versions 0.3.0 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.3.1:*:*:*:*:ruby:*:* Versions 0.3.1 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.3.2:*:*:*:*:ruby:*:* Versions 0.3.2 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.3.3:*:*:*:*:ruby:*:* Versions 0.3.3 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.3.4:*:*:*:*:ruby:*:* Versions 0.3.4 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.3.5:*:*:*:*:ruby:*:* Versions 0.3.5 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.3.6:*:*:*:*:ruby:*:* Versions 0.3.6 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.3.7:*:*:*:*:ruby:*:* Versions 0.3.7 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.3.8:*:*:*:*:ruby:*:* Versions 0.3.8 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.3.9:*:*:*:*:ruby:*:* Versions 0.3.9 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.3.10:*:*:*:*:ruby:*:* Versions 0.3.10 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.0:*:*:*:*:ruby:*:* Versions 0.4.0 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.1:*:*:*:*:ruby:*:* Versions 0.4.1 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.2:*:*:*:*:ruby:*:* Versions 0.4.2 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.3:*:*:*:*:ruby:*:* Versions 0.4.3 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.4:*:*:*:*:ruby:*:* Versions 0.4.4 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.5:*:*:*:*:ruby:*:* Versions 0.4.5 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.6:*:*:*:*:ruby:*:* Versions 0.4.6 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.7:*:*:*:*:ruby:*:* Versions 0.4.7 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.8:*:*:*:*:ruby:*:* Versions 0.4.8 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.9:*:*:*:*:ruby:*:* Versions 0.4.9 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.10:*:*:*:*:ruby:*:* Versions 0.4.10 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.11:*:*:*:*:ruby:*:* Versions 0.4.11 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.12:*:*:*:*:ruby:*:* Versions 0.4.12 Vulnerable ·Herry
  • cpe:2.3:a:herry:sfpagent:0.4.13:*:*:*:*:ruby:*:* Versions 0.4.13 Vulnerable ·Herry

Remediation

  • Fix · GHSA-vm28-mrm7-fpjq sfpagent (RubyGems) Fixed in 0.4.15 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-2888
  2. 2026-10-03 Alias added: GHSA-vm28-mrm7-fpjq

References

Exploit 2

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences