PT-2020-5647 · Ruby+5 · Rack+5

Saltyyolk · Published 2020-05-22 · Updated 2025-06-25 · CVE-2020-8161

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions rack versions prior to 2.2.0

Description A directory traversal issue exists in the Rack::Directory app, allowing an attacker to perform a directory traversal attack, which could result in information disclosure. The vulnerability is related to the check forbidden function in the rack/directory.rb module, which incorrectly restricts the directory path name. This could allow a remote attacker to access confidential data.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Rack::Directory app until a patch is available.

Exploit

Fix

Path traversal

RCE

Weakness Enumeration

CWE-22

CWE-20

CWE-548

Related Identifiers

BDU:2021-01344

BDU:2021-01347

CVE-2020-8161

DLA-2216-1

DLA-2275-1

DLA-3298-1

GHSA-5F9H-9PJV-V6J7

MGASA-2020-0252

OPENSUSE-SU-2022_3347-1

RHSA-2020:4366

SUSE-SU-2020:2678-1

SUSE-SU-2022:3347-1

SUSE-SU-2022_3347-1

USN-4561-1

USN-4561-2

Affected Products

Astra Linux

Linuxmint

Rack

Red Os

Suse

Ubuntu

References · 58

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2020-8161.yml · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2022:3347-1 · Vendor Advisory
• https://usn.ubuntu.com/4561-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0252.html · Security Note
• https://osv.dev/vulnerability/USN-4561-2 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2216-1 · Vendor Advisory
• https://debian.org/lts/security/2020/dla-2216 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8161 · Security Note
• https://osv.dev/vulnerability/DLA-3298-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4561-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-8184 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8184 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2275-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4561-2 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0316SE47MD · Vendor Advisory