logo

Database

Lack of data validation - Path Traversal In actionpack

Description

actionpack Path Traversal vulnerability Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2014-01302. NVD-2014-01303. OSV-2014-01304. GCVE-2014-01305. access.redhat.com6. access.redhat.com7. access.redhat.com8. ACCESS-CVE-2014-0130

References

1. https://bugzilla.redhat.com/show_bug.cgi?id=10951052. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2014-0130.yml3. https://groups.google.com/forum/#!topic/rubyonrails-security/NkKc7vTW70o4. https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ5. https://web.archive.org/web/20140518192004/http://www.securityfocus.com/bid/672446. https://web.archive.org/web/20150319054505/http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf7. https://web.archive.org/web/20210411041816/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ8. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-01309. http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf10. http://rhn.redhat.com/errata/RHSA-2014-1863.html11. http://osvdb.org/show/osvdb/10670412. https://groups.google.com/forum/#!topic/ruby-security-ann/PyJo7_m-Ehk13. https://github.com/omarkurt/cve-2014-0130

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.