PT-2014-3491 · Ruby+1 · Ruby On Rails+1
CVE-2014-0130
·
Publicado
2014-05-07
·
Atualizado
2025-04-03
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Ruby on Rails versions prior to 3.2.18
Ruby on Rails versions 4.0.x prior to 4.0.5
Ruby on Rails versions 4.1.x prior to 4.1.1
Description
The issue allows remote attackers to read arbitrary files via a crafted request, due to a directory traversal vulnerability in the implicit-render implementation in actionpack/lib/abstract controller/base.rb, when certain route globbing configurations are enabled.
Recommendations
For Ruby on Rails versions prior to 3.2.18, update to version 3.2.18 or later.
For Ruby on Rails versions 4.0.x prior to 4.0.5, update to version 4.0.5 or later.
For Ruby on Rails versions 4.1.x prior to 4.1.1, update to version 4.1.1 or later.
As a temporary workaround, consider disabling route globbing configurations until a patch is applied.
Exploit
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Ruby On Rails