PT-2019-12539 · Apache+1 · Apache Http Server+1

Dhiraj Mishra · Publicado 2019-05-10 · Atualizado 2024-08-04 · CVE-2019-11879

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WEBrick gem version 1.4.2

Description The issue allows directory traversal if an attacker had local access to create a symlink to a location outside of the web root directory. The vendor considers this analogous to Options FollowSymlinks in the Apache HTTP Server.

Recommendations For WEBrick gem version 1.4.2, consider restricting access to creating symlinks outside of the web root directory to minimize the risk of exploitation.

Correção

Link Following

Path traversal

Enumeração de Fraquezas

CWE-59

CWE-22

Identificadores relacionados

CVE-2019-11879

Produtos afetados

Apache Http Server

Webrick

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-11879 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11879 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11879 · Nota
• https://bugs.ruby-lang.org/issues/15835 · Aviso do Fabricante