Veille CVE
CVE-2016-0752
7.5 Élevée Exploitée activementCatalogue CISA KEV — Ruby on Rails Directory Traversal Vulnerability
Ajoutée le 25/03/2022 · Échéance de correction (agences US) : 15/04/2022
Action requise : Apply updates per vendor instructions.
Description
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.5 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | 7.5 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | 5.0 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Faiblesses (CWE)
Références
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html Permissions Required
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html Permissions Required
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html Mailing ListThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0296.html Third Party Advisory
- http://www.debian.org/security/2016/dsa-3464 Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/01/25/13 ExploitMailing List
- http://www.securityfocus.com/bid/81801 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1034816 Broken LinkThird Party AdvisoryVDB Entry
- https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ Broken Link
- https://www.exploit-db.com/exploits/40561/ ExploitThird Party AdvisoryVDB Entry
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178044.html Permissions Required
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178069.html Permissions Required
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html Mailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html Mailing ListThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0296.html Third Party Advisory
- http://www.debian.org/security/2016/dsa-3464 Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/01/25/13 ExploitMailing List
- http://www.securityfocus.com/bid/81801 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1034816 Broken LinkThird Party AdvisoryVDB Entry
- https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ Broken Link
- https://www.exploit-db.com/exploits/40561/ ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0752 US Government Resource