logo

Database

Lack of data validation - Path Traversal In ruby

Description

In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 17

10

Aliases

1. CVE-2021-289662. NVD-2021-289663. OSV-ALPINE-2021-289664. OSV-2021-289665. GCVE-2021-289666. SECURITY-CVE-2021-289667. security.netapp.com

References

1. https://github.com/ruby/tmpdir/pull/82. https://github.com/ruby/tmpdir/commit/93798c01cb7c10476e50a4d80130a329ba47f3483. https://hackerone.com/reports/11314654. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/tmpdir/CVE-2021-28966.yml5. https://rubygems.org/gems/tmpdir6. https://security.netapp.com/advisory/ntap-20210902-00047. https://www.ruby-lang.org/en/news/2021/04/05/tempfile-path-traversal-on-windows-cve-2021-28966

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.