CVE-2016-0752

Опубликовано: 16 фев. 2016

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Критический

Описание

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

Ссылки

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html
Permissions Required
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html
Permissions Required
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
Mailing List
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0296.html
Third Party Advisory
http://www.debian.org/security/2016/dsa-3464
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/01/25/13
Exploit
Mailing List
http://www.securityfocus.com/bid/81801
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1034816
Broken Link
Third Party Advisory
VDB Entry
https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ
Broken Link
https://www.exploit-db.com/exploits/40561/
Exploit
Third Party Advisory
VDB Entry
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html
Permissions Required
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html
Permissions Required
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
Mailing List
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0296.html
Third Party Advisory
http://www.debian.org/security/2016/dsa-3464
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/01/25/13
Exploit
Mailing List

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*

Версия до 3.2.22.1 (исключая)

cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*

Версия от 4.0.0 (включая) до 4.1.14.1 (исключая)

cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*

Версия от 4.2.0 (включая) до 4.2.5.1 (исключая)

cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_module_for_containers:12:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.92705

Критический

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

CVE-2016-0752

CVSS3: 7.5

ubuntu

почти 10 лет назад

CVE-2016-0752

redhat

около 10 лет назад

CVE-2016-0752

CVSS3: 7.5

debian

почти 10 лет назад

Directory traversal vulnerability in Action View in Ruby on Rails befo ...

GHSA-xrr4-p6fq-hjg7

CVSS3: 7.5

github

больше 8 лет назад

Directory traversal vulnerability in Action View in Ruby on Rails

BDU:2016-00577

fstec

почти 10 лет назад

Уязвимость программной платформы Ruby on Rails, позволяющая нарушителю читать произвольные файлы

EPSS

Процентиль: 100%

0.92705

Критический

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22