Описание
YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.
A flaw was found in YARD, a Ruby Documentation tool. When using yard server to serve documentation, a path traversal vulnerability allows a remote attacker to access arbitrary files on the host machine through unsanitized HTTP requests. This could lead to unauthorized information disclosure from the server.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/backend | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/system | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/backend | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/system | Out of support scope | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/backend-rhel8 | Out of support scope | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel7 | Out of support scope | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel8 | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel9 | Not affected | ||
| Red Hat Hardened Images | nghttp2 | Not affected | ||
| Red Hat Hardened Images | rust | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.
YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. This issue has been patched in version 0.9.42.
YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path tra ...
yard: Possible arbitrary path traversal and file access via yard server
EPSS
5.3 Medium
CVSS3