Lucene search

HackeroneCVE-2018-3760

HistoryJun 26, 2018 - 7:29 p.m.

CVE-2018-3760

2018-06-2619:29:00

CWE-200

CWE-22

hackerone

web.nvd.nist.gov

122

cve-2018-3760

sprockets

information leak

vulnerability

file access

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

High

EPSS

0.016

Percentile

87.7%

JSON

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application’s root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

Affected configurations

Nvd

Vulners

Node

redhatcloudformsMatch4.5

redhatcloudformsMatch4.6

redhatenterprise_linuxMatch6.0

redhatenterprise_linuxMatch6.7

redhatenterprise_linuxMatch7.0

redhatenterprise_linuxMatch7.3

redhatenterprise_linuxMatch7.4

redhatenterprise_linuxMatch7.5

redhatenterprise_linuxMatch7.6

Node

sprockets_projectsprocketsRange2.0.0–2.12.4

sprockets_projectsprocketsRange3.0.0–3.7.1

sprockets_projectsprocketsMatch4.0.0beta1

sprockets_projectsprocketsMatch4.0.0beta2

sprockets_projectsprocketsMatch4.0.0beta3

sprockets_projectsprocketsMatch4.0.0beta4

sprockets_projectsprocketsMatch4.0.0beta5

sprockets_projectsprocketsMatch4.0.0beta6

sprockets_projectsprocketsMatch4.0.0beta7

Node

debiandebian_linuxMatch9.0

VendorProductVersionCPE
redhatcloudforms4.5cpe:2.3:a:redhat:cloudforms:4.5:*:*:*:*:*:*:*
redhatcloudforms4.6cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*
redhatenterprise_linux6.0cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
redhatenterprise_linux6.7cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*
redhatenterprise_linux7.0cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
redhatenterprise_linux7.3cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*
redhatenterprise_linux7.4cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*
redhatenterprise_linux7.5cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*
redhatenterprise_linux7.6cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*
sprockets_projectsprockets*cpe:2.3:a:sprockets_project:sprockets:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	cloudforms	4.5	cpe:2.3:a:redhat:cloudforms:4.5:::::::*
redhat	cloudforms	4.6	cpe:2.3:a:redhat:cloudforms:4.6:::::::*
redhat	enterprise_linux	6.0	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
redhat	enterprise_linux	6.7	cpe:2.3:o:redhat:enterprise_linux:6.7:::::::*
redhat	enterprise_linux	7.0	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
redhat	enterprise_linux	7.3	cpe:2.3:o:redhat:enterprise_linux:7.3:::::::*
redhat	enterprise_linux	7.4	cpe:2.3:o:redhat:enterprise_linux:7.4:::::::*
redhat	enterprise_linux	7.5	cpe:2.3:o:redhat:enterprise_linux:7.5:::::::*
redhat	enterprise_linux	7.6	cpe:2.3:o:redhat:enterprise_linux:7.6:::::::*
sprockets_project	sprockets	*	cpe:2.3:a:sprockets_project:sprockets::::::::

Rows per page:

1-10 of 181

CNA Affected

[
  {
    "product": "Sprockets",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "4.0.0.beta8, 3.7.2, 2.12.5"
      }
    ]
  }
]

References

access.redhat.com/errata/RHSA-2018:2244

access.redhat.com/errata/RHSA-2018:2245

access.redhat.com/errata/RHSA-2018:2561

access.redhat.com/errata/RHSA-2018:2745

github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5

groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJ

www.debian.org/security/2018/dsa-4242