CVE-2015-2179: 
Ruby vulnerability analysis and mitigation

The xaviershay-dm-rails gem version 0.10.3.8 for Ruby contains a security vulnerability that allows local users to discover MySQL credentials. The vulnerability was discovered by Larry W. Cashdollar and was assigned CVE-2015-2179. The issue was reported to the vendor on February 17, 2015 (Vapid Advisory).

The vulnerability exists in the execute function within /datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb (lines 169-177). The function exposes user credentials to the process table when executing MySQL statements by passing username and password as command-line arguments. This implementation allows the credentials to be visible in process listings (Vapid Advisory). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) (NVD).

The vulnerability allows local users to discover MySQL database credentials by listing process information and its arguments. This exposure of sensitive authentication information could potentially lead to unauthorized database access (Vapid Advisory).