PT-2014-8291 · Rails+1 · Sprockets+1

Published 2014-11-08 · Updated 2023-02-13 · CVE-2014-7819

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sprockets versions prior to 2.0.5 Sprockets versions 2.1.x prior to 2.1.4 Sprockets versions 2.2.x prior to 2.2.3 Sprockets versions 2.3.x prior to 2.3.3 Sprockets versions 2.4.x prior to 2.4.6 Sprockets versions 2.5.x prior to 2.5.1 Sprockets versions 2.6.x and 2.7.x prior to 2.7.1 Sprockets versions 2.8.x prior to 2.8.3 Sprockets versions 2.9.x prior to 2.9.4 Sprockets versions 2.10.x prior to 2.10.2 Sprockets versions 2.11.x prior to 2.11.3 Sprockets versions 2.12.x prior to 2.12.3 Sprockets versions 3.x prior to 3.0.0.beta.3

Description Multiple directory traversal vulnerabilities in server.rb in Sprockets allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding. This issue affects Sprockets as distributed with Ruby on Rails 3.x and 4.x.

Recommendations For Sprockets version prior to 2.0.5, update to version 2.0.5 or later. For Sprockets version 2.1.x prior to 2.1.4, update to version 2.1.4 or later. For Sprockets version 2.2.x prior to 2.2.3, update to version 2.2.3 or later. For Sprockets version 2.3.x prior to 2.3.3, update to version 2.3.3 or later. For Sprockets version 2.4.x prior to 2.4.6, update to version 2.4.6 or later. For Sprockets version 2.5.x prior to 2.5.1, update to version 2.5.1 or later. For Sprockets version 2.6.x and 2.7.x prior to 2.7.1, update to version 2.7.1 or later. For Sprockets version 2.8.x prior to 2.8.3, update to version 2.8.3 or later. For Sprockets version 2.9.x prior to 2.9.4, update to version 2.9.4 or later. For Sprockets version 2.10.x prior to 2.10.2, update to version 2.10.2 or later. For Sprockets version 2.11.x prior to 2.11.3, update to version 2.11.3 or later. For Sprockets version 2.12.x prior to 2.12.3, update to version 2.12.3 or later. For Sprockets version 3.x prior to 3.0.0.beta.3, update to version 3.0.0.beta.3 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-7819

GHSA-33PP-3763-MRFP

GHSA-R4X3-G983-9G48

MGASA-2015-0074

SUSE-SU-2015:0787-1

SUSE-SU-2015:0863-1

Affected Products

Ruby On Rails

Sprockets

References · 23

• https://cve.org/CVERecord?id=CVE-2014-7819 · Security Note
• http://lists.opensuse.org/opensuse-updates/2014-11/msg00103.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-33pp-3763-mrfp · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-11/msg00110.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7819 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7819 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-7819 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-11/msg00111.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r4x3-g983-9g48 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-7819 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0074.html · Security Note
• http://lists.opensuse.org/opensuse-updates/2014-11/msg00105.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-7819 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0074 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-7819 · Vendor Advisory