CVE-2019-5419

🗓️ 27 Mar 2019 13:43:19Reported by hackeroneType

cve🔗 web.nvd.nist.gov👁 269 Views🌐 WEB

Possible denial of service vulnerability in Action View (Rails) <5.2.2.

Reporter	Title	Published	Views	Family All 119
IBM Security Bulletins	Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2019-5419).	10 Oct 201919:56	–	ibm
FreeBSD	Rails -- Action View vulnerabilities	13 Mar 201900:00	–	freebsd
GithubExploit	Exploit for Path Traversal in Rubyonrails Rails	16 Mar 201911:58	–	githubexploit
GithubExploit	Exploit for Path Traversal in Rubyonrails Rails	23 Mar 201902:52	–	githubexploit
BDU FSTEC	The vulnerability of the Action View component of the Ruby on Rails software platform, which allows a hacker to trigger a service failure.	23 Apr 201900:00	–	bdu_fstec
Cvelist	CVE-2019-5419	27 Mar 201913:43	–	cvelist
Debian	[SECURITY] [DLA 1739-1] rails security update	31 Mar 201913:51	–	debian
Debian CVE	CVE-2019-5419	27 Mar 201913:43	–	debiancve
Tenable Nessus	Debian DLA-1739-1 : rails security update	1 Apr 201900:00	–	nessus
Tenable Nessus	Fedora 30 : 1:rubygem-actionmailer / 1:rubygem-actionpack / etc (2019-1cfe24db5c)	10 May 201900:00	–	nessus

NVD

Vulners

Node

rubyonrails railsRange<4.2.11.1

rubyonrails railsRange5.0.0–5.0.7.2

rubyonrails railsRange5.1.0–5.1.6.2

rubyonrails railsRange5.2.0–5.2.2.1

Node

debian debian_linuxMatch8.0

Node

redhat cloudformsMatch4.6

redhat cloudformsMatch4.7

redhat software_collectionsMatch1.0

Node

opensuse leapMatch15.0

opensuse leapMatch15.1

Node

fedoraproject fedoraMatch30

[
  {
    "product": "https://github.com/rails/rails",
    "vendor": "Rails",
    "versions": [
      {
        "status": "affected",
        "version": "5.2.2.1"
      },
      {
        "status": "affected",
        "version": "5.1.6.2"
      },
      {
        "status": "affected",
        "version": "5.0.7.2"
      },
      {
        "status": "affected",
        "version": "4.2.11.1"
      }
    ]
  }
]

Source	Link
access	www.access.redhat.com/errata/RHSA-2019:1147
weblog	www.weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
groups	www.groups.google.com/forum/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
lists	www.lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html
lists	www.lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html
openwall	www.openwall.com/lists/oss-security/2019/03/22/1
access	www.access.redhat.com/errata/RHSA-2019:0796
access	www.access.redhat.com/errata/RHSA-2019:1289
access	www.access.redhat.com/errata/RHSA-2019:1149

Parameter	Position	Path	Description	CWE
encoded_key	path	/rails/active_storage/disk/:encoded_key/*filename(.:format)	Exploit URL for Rails 5.2.2 RCE via path traversal and deserialization vulnerability	CWE-400, CWE-770
filename	path	/rails/active_storage/disk/:encoded_key/*filename(.:format)	Exploit URL for Rails 5.2.2 RCE via path traversal and deserialization vulnerability	CWE-400, CWE-770

17 Jun 2026 02:37Current

8.1High risk

Vulners AI Score8.1

CVSS 3.17.5

CVSS 27.8

EPSS0.08671

denial of service vulnerability action view rails nvd cve-2019-5419