PT-2019-12539 · Apache+1 · Apache Http Server+1

Dhiraj Mishra · Published 2019-05-10 · Updated 2024-08-04 · CVE-2019-11879

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WEBrick gem version 1.4.2

Description The issue allows directory traversal if an attacker had local access to create a symlink to a location outside of the web root directory. The vendor considers this analogous to Options FollowSymlinks in the Apache HTTP Server.

Recommendations For WEBrick gem version 1.4.2, consider restricting access to creating symlinks outside of the web root directory to minimize the risk of exploitation.

Fix

Link Following

Path traversal

Weakness Enumeration

CWE-59

CWE-22

Related Identifiers

CVE-2019-11879

Affected Products

Apache Http Server

Webrick

References · 4

• https://osv.dev/vulnerability/CVE-2019-11879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11879 · Security Note
• https://bugs.ruby-lang.org/issues/15835 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11879 · Note