CVE-2014-0130

2014-05-0710:55:00

CWE-22

[email protected]

web.nvd.nist.gov

889

In Wild

cve-2014-0130

directory traversal

ruby on rails

remote attackers

nvd

information security

6.2 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

70.7%

JSON

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

CPENameOperatorVersion
redhat:subscription_asset_managerredhat subscription asset managerle1.3.0
rubyonrails:ruby_on_railsrubyonrails ruby on railsle3.2.17
rubyonrails:railsrubyonrails railseq4.0.0
rubyonrails:railsrubyonrails railseq4.0.1
rubyonrails:railsrubyonrails railseq4.0.2
rubyonrails:railsrubyonrails railseq4.1.0
rubyonrails:railsrubyonrails railseq3.2.0
rubyonrails:railsrubyonrails railseq3.2.7
rubyonrails:railsrubyonrails railseq3.2.8
rubyonrails:railsrubyonrails railseq3.2.9

CPE	Name	Operator	Version
redhat:subscription_asset_manager	redhat subscription asset manager	le	1.3.0
rubyonrails:ruby_on_rails	rubyonrails ruby on rails	le	3.2.17
rubyonrails:rails	rubyonrails rails	eq	4.0.0
rubyonrails:rails	rubyonrails rails	eq	4.0.1
rubyonrails:rails	rubyonrails rails	eq	4.0.2
rubyonrails:rails	rubyonrails rails	eq	4.1.0
rubyonrails:rails	rubyonrails rails	eq	3.2.0
rubyonrails:rails	rubyonrails rails	eq	3.2.7
rubyonrails:rails	rubyonrails rails	eq	3.2.8
rubyonrails:rails	rubyonrails rails	eq	3.2.9